baseline-rb 0.2.0 → 0.3.0

data/lib/baseline/parser.rb

@@ -3,12 +3,24 @@
 require "ctx_parser/configuration"
 require "ctx_parser/input"
 require_relative "document"
-require_relative "facts"
+require_relative "fact_builder"
 require_relative "credential"
 
 module Baseline
-  # 共享输入与提取边界；CtxParser 跟踪来源，Facts 归纳领域证据。
+  # 共享输入与提取边界；CtxParser 跟踪来源，FactBuilder 归纳领域证据。
   class Parser < CtxParser::Configuration
+    # 只有明确声明的事实才属于适配器契约；新增规则不能默认获得实现能力。
+    SUPPORTED_FACTS = %w[
+      snmp.enabled snmp.versions snmp.write_enabled snmp.v3_auth_priv snmp.acl.bound snmp.acl.restricted snmp.acl.sources
+      ntp.servers ntp.authentication ntp.source syslog.servers syslog.source
+      ssh.enabled ssh.versions ssh.vty_ssh_only ssh.vty_aaa management.acl.bound management.acl.restricted management.acl.sources
+      services credentials.storage_safe credentials.records tacacs.servers tacacs.login tacacs.authorization tacacs.accounting tacacs.keys_present
+    ].freeze
+
+    # 声明尚未建模的事实；未知能力不能通过空值或默认值伪装成已支持。
+    UNSUPPORTED_FACTS = {}.freeze
+    PARTIAL_FACTS = {}.freeze
+
     SERVICE_PORTS = { "ssh" => 22, "telnet" => 23, "snmp" => 161, "snmptrap" => 162 }.freeze
     SNMP_OPTIONS = %w[auth priv authentication-mode privacy-mode acl access use-ipv4acl group local engineid engineID
       encrypted localizedkey localizedV2key remote udp-port].freeze
@@ -28,28 +40,38 @@ module Baseline
         issues << { code: :incomplete_final_line, line: cursor.lines.last.number }
       end
       @source_issues = issues
-      @facts = Facts.new(complete: complete, issues: issues)
+      @fact_builder = FactBuilder.new(complete: complete, issues: issues)
       if roots.empty?
         return CtxParser::Result.new(status: :failed, issues: issues + [ { code: :empty_configuration } ])
       end
       prepare_configuration
-      if (hostname = matching_blocks(hostname_pattern).last)
-        name = analyze(hostname) { hostname.text[hostname_pattern, 1] }
-        record("hostname", name)
-        capture(hostname, name, [ "facts", "hostname" ])
+      if (hostname = matching_blocks(hostname_family_pattern).last)
+        name = effective_configured_value(hostname_pattern, entries: [ hostname ], family: hostname_family_pattern, fact: "hostname")
+        if name
+          record_fact("hostname", name)
+          capture(hostname, name, [ "facts", "hostname" ])
+        end
       end
-      access_lists
-      management
-      services
-      authentication
-      @facts.result
+      parse_access_lists
+      parse_management
+      parse_services
+      parse_authentication
+      self.class::UNSUPPORTED_FACTS.each_key { |path| record_unknown_fact(path, code: :unsupported_capability) }
+      @fact_builder.build
+    end
+
+    # 以相同顺序编排各厂商的原子领域能力，语法提取由适配器实现。
+    def parse_services
+      parse_ntp
+      parse_syslog
+      parse_snmp
     end
 
     # 在领域解析前准备当前配置的词元和引用索引。
     def prepare_configuration; end
 
     # 不使用命名 ACL 的平台由原生管理来源声明提供事实。
-    def access_lists; end
+    def parse_access_lists; end
 
     # 返回本次解析的根配置块。
     def roots = @blocks
@@ -57,6 +79,8 @@ module Baseline
     def document_class = Document
     # 匹配当前平台显式声明的主机名。
     def hostname_pattern = /\A(?:hostname|sysname)\s+(\S+)\z/
+    # 损坏的最终身份声明也属于同族，不能继续使用旧身份选择设备策略。
+    def hostname_family_pattern = /\A(?:hostname|sysname)(?:\s|\z)/
     # 保留原始文本，但不将可能截断的词元纳入事实构建树。
     def exclude_incomplete_final_line
       line = cursor.lines.last
@@ -90,6 +114,57 @@ module Baseline
       end.uniq
     end
 
+    # 地址语法在输入边界校验；损坏的服务器声明不能变成已知的空集或数量。
+    def configured_server_addresses(scope, pattern, entries, negate: nil)
+      values = {}
+      entries.each do |entry|
+        negative = negate && entry.text.start_with?("#{negate} ")
+        text = negative ? entry.text.delete_prefix("#{negate} ") : entry.text
+        match = pattern.match(text)
+        address = match && match[1]
+        unless server_address?(address)
+          record_unknown_fact(scope, [ entry ], code: :invalid_server_address)
+          next
+        end
+        identity = block_given? ? yield(text, match) : address
+        unless identity
+          record_unknown_fact(scope, [ entry ], code: :unsupported_server_options)
+          next
+        end
+        analyze(entry) { address }
+        negative ? values.delete(identity) : values[identity] = address
+      end
+      values.values.uniq
+    end
+
+    # 服务器可选项必须完整消费；未知参数、重复项及缺失值不能作为有效配置。
+    def parse_server_options(text, flags: [], integers: {}, names: [], interfaces: [])
+      parts, values = text.split, {}
+      keywords = flags + integers.keys + names + interfaces
+      until parts.empty?
+        key = parts.shift
+        return if values.key?(key) || !keywords.include?(key)
+        if flags.include?(key)
+          values[key] = true
+          next
+        end
+        value = parts.shift
+        return if value.nil? || keywords.include?(value)
+        if integers.key?(key)
+          return unless /\A\d+\z/.match?(value) && integers.fetch(key).cover?(value.to_i)
+          value = value.to_i
+        elsif interfaces.include?(key)
+          return unless /\A[a-zA-Z][\w.:\/-]*\z/.match?(value)
+          value += parts.shift if !/\d/.match?(value) && /\A\d[\d.:\/-]*\z/.match?(parts.first.to_s)
+          return unless /\d/.match?(value)
+        end
+        values[key] = value
+      end
+      return if values.key?("minpoll") && values.key?("maxpoll") && values["minpoll"] > values["maxpoll"]
+
+      values
+    end
+
     # 按配置顺序选取最后一条匹配声明。
     def last_configured_value(pattern, entries = roots)
       entry = entries.reverse.find { |candidate| !candidate.text[pattern, 1].nil? }
@@ -98,25 +173,51 @@ module Baseline
       analyze(entry) { entry.text[pattern, 1] }
     end
 
+    # 先选取最后一条同族声明，再校验语法，避免回落到已被撤销或损坏的旧值。
+    def effective_configured_value(pattern, entries: roots, family:, fact:, reset: nil)
+      entry = entries.reverse.find { |candidate| family.match?(candidate.text) }
+      return unless entry
+      return analyze(entry) { nil } if reset&.match?(entry.text)
+      match = pattern.match(entry.text)
+      return analyze(entry) { match[1] } if match
+
+      record_unknown_fact(fact, [ entry ])
+      nil
+    end
+
+    # 保存最后生效的标量声明及对应来源，不将被覆盖的声明作为当前证据。
+    def record_configured_value(path, pattern, entries = roots)
+      entry = entries.reverse.find { |candidate| !candidate.text[pattern, 1].nil? }
+      return unless entry
+
+      record_fact(path, analyze(entry) { entry.text[pattern, 1] }, [ entry ])
+    end
+
+    # 启用状态可能由正向或撤销声明决定，保留所有参与归约的来源。
+    def record_configured_state(path, on, off)
+      entries = roots.select { |entry| on.match?(entry.text) || off.match?(entry.text) }
+      record_fact(path, configured_state(on, off, entries), entries)
+    end
+
     # 保存归一化事实及其来源证据。
-    def record(path, value, entries = [])
-      return unless @facts.record(path, value, lines: entries.map(&:line))
+    def record_fact(path, value, entries = [])
+      return unless @fact_builder.record_fact(path, value, lines: entries.map(&:line))
 
       # 来源块中尚未解释的命令不能标记为解析成功。
       cursor.capture_many(entries.select { |entry| cursor.parsed?(entry.index) }, data: value, path: [ "facts", path ])
     end
 
     # 记录事实不可用的原因，并保留对应的来源行。
-    def unknown(path, entries = [], code: :unsupported_syntax)
-      @facts.unknown(path, lines: entries.map(&:line), code: code)
+    def record_unknown_fact(path, entries = [], code: :unsupported_syntax)
+      @fact_builder.record_unknown_fact(path, lines: entries.map(&:line), code: code)
       entries.each { |entry| cursor.mark(entry.index, state: :unsupported) }
     end
 
     # 未解析的访问声明不能抹除其他已确认的写权限。
-    def unknown_snmp_access(entries, code: :unsupported_syntax)
-      @facts.unknown_snmp_permission(lines: entries.map(&:line), code: code)
+    def record_unknown_snmp_access(entries, code: :unsupported_syntax)
+      @fact_builder.record_unknown_snmp_permission(lines: entries.map(&:line), code: code)
       %w[snmp.communities snmp.community_present snmp.users snmp.versions snmp.v3_auth_priv snmp.acl].each do |path|
-        unknown(path, entries, code: code)
+        record_unknown_fact(path, entries, code: code)
       end
     end
 
@@ -136,7 +237,7 @@ module Baseline
     # 记录凭据属性，不保留凭据秘密值。
     def record_credential(owner, kind, format, secret, entry)
       value = analyze(entry) { Credential.new(owner: owner, kind: kind, format: format, secret: secret, line: entry.line) }
-      index = @facts.record_credential(value)
+      index = @fact_builder.record_credential(value)
       capture(entry, value.to_h, [ "facts", "credentials.records", index ])
     end
 
@@ -156,7 +257,7 @@ module Baseline
       end
       acl = Acl.new(name: name, line: entries.first&.line, rules: parsed.compact,
         supported: supported && !damaged && parsed.none?(&:nil?))
-      if @facts.register_acl(acl, aliases: aliases, lines: entries.map(&:line)).any?
+      if @fact_builder.register_acl(acl, aliases: aliases, lines: entries.map(&:line)).any?
         entries.each { |entry| cursor.mark(entry.index, state: :unsupported) }
       end
     end
@@ -172,16 +273,20 @@ module Baseline
     end
 
     # 归一化 ACL 来源地址；不推测不支持语法的含义。
-    def acl_source_network(parts)
+    def parse_acl_source_network(parts)
       token = parts.shift
       return "0.0.0.0/0" if token == "any"
-      token = parts.shift if token == "host"
+      if token == "host"
+        address = parts.shift
+        raise ArgumentError, "A host requires one IPv4 address" unless address&.match?(/\A\d+(?:\.\d+){3}\z/)
+        return Acl.source_network(address)
+      end
       wildcard = parts.shift if parts.first&.match?(/\A(?:\d+(?:\.\d+){3}|0)\z/)
       Acl.source_network(token, wildcard)
     end
 
     # 显式端口名称仅属于配置语法，不代表组织批准值。
-    def service_port(token)
+    def parse_service_port(token)
       return SERVICE_PORTS[token] unless token&.match?(/\A\d+\z/)
       value = token.to_i
       value if value.between?(0, 65_535)
@@ -206,19 +311,19 @@ module Baseline
       entry = entries.last
       return analyze(entry) { default } if entry.text == "#{negate} #{command}"
       token = entry.text[/\A#{prefix}\s+(\d+)\z/, 1]
-      port = service_port(token)
+      port = parse_service_port(token)
       return analyze(entry) { port } if port && port.positive?
-      unknown_listener_port(scope, entries)
+      record_unknown_listener_port(scope, entries)
       nil
     end
 
     # 监听端口无法解析时，将依赖该端口的事实保留为未知。
-    def unknown_listener_port(scope, entries)
-      %w[sources restricted].each { |field| unknown("#{scope}.#{field}", entries, code: :unsupported_service_port) }
+    def record_unknown_listener_port(scope, entries)
+      %w[sources restricted].each { |field| record_unknown_fact("#{scope}.#{field}", entries, code: :unsupported_service_port) }
     end
 
     # 区分模式未声明、格式无效及包含完整算法与秘密值的声明。
-    def snmp_secret(settings, keyword, algorithms:, optional_algorithm: false, aes_size: false)
+    def parse_snmp_secret(settings, keyword, algorithms:, optional_algorithm: false, aes_size: false)
       tokens = settings.split
       index = tokens.index(keyword)
       return false unless index
@@ -236,23 +341,23 @@ module Baseline
     end
 
     # 提取 SNMP 凭据属性，不持久化秘密值。
-    def snmp_credentials(owner, modes, entry, format: nil)
+    def record_snmp_credentials(owner, modes, entry, format: nil)
       modes.each_value do |value|
         next if value == false
         stored_format, secret = value || [ "unknown", nil ]
         record_credential(owner, "snmp_user", stored_format || format || "unknown", secret, entry)
       end
-      unknown("snmp.v3_auth_priv", [ entry ], code: :invalid_snmp_security) if modes.value?(nil)
+      record_unknown_fact("snmp.v3_auth_priv", [ entry ], code: :invalid_snmp_security) if modes.value?(nil)
       modes.transform_values { |value| value ? true : value }
     end
 
     # 同名组可出现在不同安全级别；后续只读声明不能消除已有写权限。
-    def snmp_groups(entries)
+    def configured_snmp_groups(entries)
       entries.map { |entry| yield(entry) }.group_by(&:first).transform_values do |definitions|
         records = definitions.map(&:last)
         acls = records.map { |record| record[:acl] }.uniq
         { acl: acls.one? ? acls.first : nil, acl_ambiguous: acls.size > 1,
-          write: Facts.write_permission(records.map { |record| record[:write] }),
+          write: FactBuilder.write_permission_state(records.map { |record| record[:write] }),
           line: records.first[:line], lines: records.map { |record| record[:line] } }
       end
     end

data/lib/baseline/policy.rb

@@ -64,12 +64,12 @@ module Baseline
 
     # 解析上下文对应的策略值，并保留选择路径。
     def resolve(rule, context)
-      resolution = resolve_with_source(rule, context)
+      resolution = resolve_with_path(rule, context)
       [ resolution.value, resolution.reason ]
     end
 
     # 保留相对于 expected 的命中范围、默认分支或未解析选择器路径。
-    def resolve_with_source(rule, context)
+    def resolve_with_path(rule, context)
       value = rule.expected
       path = []
       while selector?(value)

data/lib/baseline/report.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "configuration"
+require_relative "evidence"
 
 require "ctx_parser/immutable"
 require "json"
@@ -12,6 +12,7 @@ module Baseline
       input_incomplete: "配置不完整，需提供完整备份后重查", unsupported_platform: "尚未支持此平台的配置语法",
       scope_mismatch: "不在策略适用范围内", scope_unknown: "缺少判断适用范围或选择批准值所需的上下文",
       policy_missing: "未定义当前范围的批准值，请完善基线策略", fact_unavailable: "配置事实缺失或包含尚未支持的语法，请查看解析诊断",
+      unsupported_capability: "此厂商的当前适配器尚未建模该能力，不能据此声明合规",
       fact_type_mismatch: "解析事实类型与检查要求不一致", unnecessary_service_enabled: "存在策略要求关闭的服务",
       service_state_unknown: "配置未明确声明部分服务状态，不能推断厂商默认值", deviation: "实际配置偏离批准值",
       unsupported_address_family: "地址格式超出当前 IPv4 检查能力", weak_password: "发现未满足强度要求的明文凭据",

data/lib/baseline/rule.rb

@@ -90,7 +90,7 @@ module Baseline
       when :string_set, :network_set then string_set?(value)
       end
       raise ArgumentError, "Invalid baseline expected value for #{id}" unless valid
-      value.each { |network| Acl.address_range(network) } if value_type == :network_set
+      value.each { |network| Acl.ipv4_range(network) } if value_type == :network_set
     end
 
     # 展示对象身份与状态，避免泄露原始回显或凭据。

data/lib/baseline/version.rb

@@ -2,5 +2,5 @@
 
 module Baseline
   # 公开包版本，供 RubyGems 元数据和运行时调用方共用。
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: baseline-rb
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Gatework contributors
@@ -13,16 +13,16 @@ dependencies:
   name: ctx_parser
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.2.0
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.2.0
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: digest
   requirement: !ruby/object:Gem::Requirement
@@ -113,20 +113,21 @@ files:
 - lib/baseline/cisco_ios/parser.rb
 - lib/baseline/cisco_nxos/parser.rb
 - lib/baseline/comware/parser.rb
-- lib/baseline/configuration.rb
 - lib/baseline/credential.rb
 - lib/baseline/document.rb
 - lib/baseline/evaluator.rb
-- lib/baseline/facts.rb
+- lib/baseline/evidence.rb
+- lib/baseline/fact_builder.rb
 - lib/baseline/h3c/parser.rb
 - lib/baseline/hillstone/document.rb
 - lib/baseline/hillstone/parser.rb
 - lib/baseline/huawei/parser.rb
+- lib/baseline/multiline_document.rb
+- lib/baseline/palo_alto/command_index.rb
 - lib/baseline/palo_alto/document.rb
 - lib/baseline/palo_alto/parser.rb
 - lib/baseline/parser.rb
 - lib/baseline/policy.rb
-- lib/baseline/quoted_document.rb
 - lib/baseline/report.rb
 - lib/baseline/rule.rb
 - lib/baseline/version.rb