baseline-rb 0.2.1 → 0.3.0

data/lib/baseline/hillstone/parser.rb

@@ -9,6 +9,15 @@ module Baseline
   module Hillstone
     # StoneOS 管理端点与原生主机允许列表不同于路由器 VTY。
     class Parser < Baseline::Parser
+      # 原生管理端点没有 VTY 模型；未建模能力保留未知，不改变规则适用范围。
+      UNSUPPORTED_FACTS = {
+        "ssh.versions" => :ssh_version_unmodeled,
+        "ssh.vty_ssh_only" => :native_management_endpoint,
+        "ssh.vty_aaa" => :native_management_endpoint,
+        "tacacs.accounting" => :platform_semantics_unresolved
+      }.freeze
+      PARTIAL_FACTS = { "services" => :service_states_partially_modeled }.freeze
+
       MANAGEMENT_SERVICES = %w[ssh telnet http https ftp snmp].freeze
       HOST_PROTOCOLS = %w[ssh telnet http https netconf any].freeze
 
@@ -23,11 +32,11 @@ module Baseline
       end
 
       # 已配置主机 ACL 本身不能证明管理监听服务已启用。
-      def management
+      def parse_management
         interfaces = matching_blocks(/\Ainterface\s+/)
         states = interfaces.map do |section|
           matching_blocks(/\A(?:no )?manage\s+/, section.children).each_with_object({}) do |entry, values|
-            parts = tokens(entry)
+            parts = command_tokens(entry)
             negative = parts.first == "no"
             parts = parts.drop(1) if negative
             next unless MANAGEMENT_SERVICES.include?(parts[1])
@@ -38,110 +47,103 @@ module Baseline
             end
           end
         end
-        services = MANAGEMENT_SERVICES.to_h do |name|
+        service_states = MANAGEMENT_SERVICES.to_h do |name|
           values = states.map { |state| state[name] }
           enabled = values.include?(true) ? true : values.any? && values.all?(false) ? false : nil
           [ name, enabled ]
         end
-        record("ssh.enabled", services["ssh"])
-        record("services", services.slice("telnet", "http", "https", "ftp"))
-        management_sources
+        record_fact("ssh.enabled", service_states["ssh"])
+        record_fact("services", service_states.slice("telnet", "http", "https", "ftp"))
+        record_management_sources
       end
 
       # 信任主机可使用 CIDR、掩码、区间或 any；跨协议按保守并集处理。
-      def management_sources
+      def record_management_sources
         entries = matching_blocks(/\A(?:no )?admin host\b/)
         sources = entries.flat_map do |entry|
-          parts = tokens(entry)
+          parts = command_tokens(entry)
           raise ArgumentError unless parts.take(2) == %w[admin host] && HOST_PROTOCOLS.include?(parts.last)
-          analyze(entry) { host_networks(parts[2...-1]) }
+          analyze(entry) { parse_host_networks(parts[2...-1]) }
         rescue ArgumentError, IPAddr::Error
-          unknown("management.acl", [ entry ], code: :unsupported_trusted_host)
+          record_unknown_fact("management.acl", [ entry ], code: :unsupported_trusted_host)
           nil
         end
         if entries.empty?
-          return unless @facts.complete?
+          return unless @fact_builder.complete?
           # 未显式配置受信任主机时，不能据此证明来源访问受限。
-          @facts.direct_acl(fact: "management.acl", sources: nil, bound: false)
+          @fact_builder.record_source_restriction(fact: "management.acl", sources: nil, bound: false)
         else
-          @facts.direct_acl(fact: "management.acl", sources: sources.include?(nil) ? nil : sources,
+          @fact_builder.record_source_restriction(fact: "management.acl", sources: sources.include?(nil) ? nil : sources,
             bound: true, lines: entries.map(&:line))
         end
       end
 
-      # 采集明确启用或禁用的管理服务。
-      def services
-        ntp
-        syslog
-        snmp
-      end
-
       # 提取时间同步服务器及相关认证配置。
-      def ntp
+      def parse_ntp
         entries = matching_blocks(/\Antp server\b/)
         sources = []
         servers = entries.filter_map do |entry|
-          parts = tokens(entry)
+          parts = command_tokens(entry)
           unless server_address?(parts[2])
-            unknown("ntp", [ entry ])
+            record_unknown_fact("ntp", [ entry ])
             next
           end
-          options = pairs(parts.drop(3), flags: [ "prefer" ], keys: %w[key source vrouter])
+          options = parse_keyword_options(parts.drop(3), flags: [ "prefer" ], keys: %w[key source vrouter])
           unless options && (!options["key"] || /\A[1-9]\d*\z/.match?(options["key"]))
-            unknown("ntp", [ entry ])
+            record_unknown_fact("ntp", [ entry ])
             next
           end
           sources << options["source"]
           analyze(entry) { parts[2] }
         end
-        record("ntp.servers", servers.uniq, entries)
+        record_fact("ntp.servers", servers.uniq, entries)
         record_configured_state("ntp.authentication", /\Antp authentication\z/, /\Ano ntp authentication\z/)
-        record("ntp.source", sources.first, entries) if sources.any? && sources.first && sources.uniq.one?
-        unknown("ntp", matching_blocks(/\Ano ntp server\b/)) if matching_blocks(/\Ano ntp server\b/).any?
+        record_fact("ntp.source", sources.first, entries) if sources.any? && sources.first && sources.uniq.one?
+        record_unknown_fact("ntp", matching_blocks(/\Ano ntp server\b/)) if matching_blocks(/\Ano ntp server\b/).any?
       end
 
       # 同一目标可供多个日志类别使用，统计时只计一次。
-      def syslog
+      def parse_syslog
         entries = matching_blocks(/\Alogging syslog\b/)
         sources = []
         servers = entries.filter_map do |entry|
-          parts = tokens(entry)
+          parts = command_tokens(entry)
           options = parts.drop(3)
           source = nil
           if %w[vrouter source-interface].include?(options.first)
             source = options[1] if options.first == "source-interface"
             options = options.drop(2)
           end
-          valid = server_address?(parts[2]) && %w[tcp udp secure-tcp].include?(options[0]) && service_port(options[1])&.positive?
+          valid = server_address?(parts[2]) && %w[tcp udp secure-tcp].include?(options[0]) && parse_service_port(options[1])&.positive?
           tail = options.drop(2)
           tail = tail.drop(1) if options[0] == "secure-tcp" && tail.first == "server-cert-check-disable"
           valid &&= tail.empty? || tail.first == "type" && tail.size >= 2
           unless valid
-            unknown("syslog", [ entry ])
+            record_unknown_fact("syslog", [ entry ])
             next
           end
           sources << source
           analyze(entry) { parts[2] }
         end
-        record("syslog.servers", servers.uniq, entries)
-        record("syslog.source", sources.first, entries) if sources.any? && sources.first && sources.uniq.one?
-        unknown("syslog", matching_blocks(/\Ano logging syslog\b/)) if matching_blocks(/\Ano logging syslog\b/).any?
+        record_fact("syslog.servers", servers.uniq, entries)
+        record_fact("syslog.source", sources.first, entries) if sources.any? && sources.first && sources.uniq.one?
+        record_unknown_fact("syslog", matching_blocks(/\Ano logging syslog\b/)) if matching_blocks(/\Ano logging syslog\b/).any?
       end
 
       # 轮询主机权限独立于出站 Trap 接收端。
-      def snmp
+      def parse_snmp
         record_configured_state("snmp.enabled", /\Asnmp-server manager\z/, /\Ano snmp-server manager\z/)
         entries = matching_blocks(/\Asnmp-server host\b/)
         versions, sources, communities = [], [], []
         entries.each do |entry|
-          parts = tokens(entry)
+          parts = command_tokens(entry)
           offset = parts.index("version")
           raise ArgumentError unless offset && offset > 2
-          networks = host_networks(parts[2...offset])
+          networks = parse_host_networks(parts[2...offset])
           settings = parts.drop(offset + 1)
           if %w[1 2c].include?(settings.first) && settings[1] == "community" && !settings[2].to_s.empty? &&
               (settings.size == 3 || settings.size == 4 && %w[ro rw].include?(settings[3]))
-            record_credential("snmp-community", "snmp", secret_format(settings[2]), settings[2], entry)
+            record_credential("snmp-community", "snmp", credential_storage_format(settings[2]), settings[2], entry)
             versions << (settings.first == "1" ? "v1" : "v2c")
             communities << { write: settings[3] == "rw", line: entry.line }
             sources.concat(networks)
@@ -153,35 +155,86 @@ module Baseline
             raise ArgumentError
           end
         rescue ArgumentError, IPAddr::Error
-          unknown_snmp_access([ entry ], code: :unsupported_snmp_host)
+          record_unknown_snmp_access([ entry ], code: :unsupported_snmp_host)
+        end
+        groups = parse_snmp_access_groups
+        users = parse_snmp_access_users
+        versions |= [ "v3" ] if users.any? || groups.any?
+        record_fact("snmp.groups", groups)
+        record_fact("snmp.versions", versions.uniq, entries)
+        unsupported = matching_blocks(/\Ano snmp-server (?:host|user|group)\b/)
+        record_unknown_snmp_access(unsupported, code: :unsupported_snmp_security) if unsupported.any?
+        if versions.include?("v3") && users.empty?
+          record_unknown_snmp_access(entries, code: :snmp_user_unresolved)
+        end
+        @fact_builder.record_snmp_access(communities: communities, users: users, groups: groups)
+        @fact_builder.record_source_restriction(fact: "snmp.acl", sources: sources, bound: true, lines: entries.map(&:line)) if entries.any?
+      end
+
+      # 组只声明访问权限；认证级别要求不能替代用户的实际密钥证据。
+      def parse_snmp_access_groups
+        entries = matching_blocks(/\Asnmp-server group\b/).select do |entry|
+          parts = command_tokens(entry)
+          options = parse_keyword_options(parts.drop(5), flags: [], keys: %w[read-view write-view])
+          valid = parts.size >= 5 && parts[3] == "v3" && %w[noauth auth auth-enc].include?(parts[4]) &&
+            !parts[2].to_s.empty? && options && options.values.none?(&:empty?)
+          record_unknown_snmp_access([ entry ], code: :unsupported_snmp_group) unless valid
+          valid
+        end
+        configured_snmp_groups(entries) do |entry|
+          parts = command_tokens(entry)
+          options = parse_keyword_options(parts.drop(5), flags: [], keys: %w[read-view write-view])
+          analyze(entry) { true }
+          [ parts[2], { write: options.key?("write-view"), line: entry.line, acl: nil } ]
+        end
+      end
+
+      # StoneOS 用户显式引用组及远端地址，秘密值仅用于提取安全属性。
+      def parse_snmp_access_users
+        matching_blocks(/\Asnmp-server user\b/).filter_map do |entry|
+          parts = command_tokens(entry)
+          valid = parts.size >= 8 && !parts[2].to_s.empty? && parts[3] == "group" && !parts[4].to_s.empty? &&
+            parts[5] == "v3" && parts[6] == "remote"
+          address = IPAddr.new(parts[7]) if valid
+          valid &&= address.ipv4? && !parts[7].include?("/")
+          security = parts.drop(8)
+          valid &&= security.empty? || [ 3, 6 ].include?(security.size) && security[0] == "auth-protocol" &&
+            %w[md5 sha].include?(security[1]) && !security[2].to_s.empty? &&
+            (security.size == 3 || security[3] == "enc-protocol" && %w[des aes].include?(security[4]) && !security[5].to_s.empty?)
+          unless valid
+            record_unknown_snmp_access([ entry ], code: :unsupported_snmp_user)
+            next
+          end
+          security.each_slice(3) do |mode|
+            record_credential("snmp:#{parts[2]}", "snmp_user", credential_storage_format(mode[2]), mode[2], entry)
+          end
+          analyze(entry) { { name: parts[2], group: parts[4], auth: security.any?, priv: security.size == 6, line: entry.line } }
+        rescue ArgumentError, IPAddr::Error
+          record_unknown_snmp_access([ entry ], code: :unsupported_snmp_user)
+          nil
         end
-        record("snmp.versions", versions.uniq, entries)
-        unsupported = matching_blocks(/\A(?:snmp-server (?:user|group)\b|no snmp-server (?:host|user|group)\b)/)
-        unknown_snmp_access(unsupported, code: :unsupported_snmp_security) if unsupported.any? || versions.include?("v3")
-        @facts.snmp(communities: communities, users: [])
-        @facts.direct_acl(fact: "snmp.acl", sources: sources, bound: true, lines: entries.map(&:line)) if entries.any?
       end
 
       # 分别记录 TACACS 定义与管理认证引用。
-      def authentication
+      def parse_authentication
         definitions = matching_blocks(/\Aaaa-server\s+/).filter_map do |section|
-          parts = tokens(section)
+          parts = command_tokens(section)
           unless parts.size == 4 && parts[2..] == %w[type tacacs+]
-            unknown("tacacs", [ section ]) if parts.include?("tacacs+")
+            record_unknown_fact("tacacs", [ section ]) if parts.include?("tacacs+")
             next
           end
           endpoints = matching_blocks(/\A(?:host|backup[12])\b/, section.children)
           servers = endpoints.filter_map do |entry|
-            values = tokens(entry)
+            values = command_tokens(entry)
             if server_address?(values[1]) && (values.size == 2 || values.size == 4 && values[2] == "vrouter")
               analyze(entry) { values[1] }
             else
-              unknown("tacacs", [ entry ])
+              record_unknown_fact("tacacs", [ entry ])
               nil
             end
           end
           secrets = matching_blocks(/\Asecret\b/, section.children)
-          keys = secrets.map { |entry| stored_secret("tacacs:#{parts[1]}", "tacacs", entry) }
+          keys = secrets.map { |entry| record_stored_credential("tacacs:#{parts[1]}", "tacacs", entry) }
           [ parts[1], { servers: servers.uniq, keys_present: keys.any? && keys.all?, line: section.line,
             declaration: section.children.empty? } ]
         end
@@ -189,62 +242,62 @@ module Baseline
           # StoneOS 会先导出空的前向声明，再导出包含内容的服务器块。
           populated = entries.map(&:last).reject { |entry| entry[:declaration] }
           selected = populated.last || entries.last.last
-          @facts.unknown("tacacs", lines: populated.map { |entry| entry[:line] }, code: :duplicate_tacacs_scheme) if populated.size > 1
+          @fact_builder.record_unknown_fact("tacacs", lines: populated.map { |entry| entry[:line] }, code: :duplicate_tacacs_scheme) if populated.size > 1
           if selected[:servers].empty?
-            @facts.unknown("tacacs.servers", lines: [ selected[:line] ], code: :tacacs_server_unresolved)
+            @fact_builder.record_unknown_fact("tacacs.servers", lines: [ selected[:line] ], code: :tacacs_server_unresolved)
           end
           [ name, selected.except(:declaration) ]
         end
-        record("tacacs.schemes", schemes)
-        record("tacacs.servers", schemes.values.flat_map { |scheme| scheme[:servers] }.uniq)
-        record("tacacs.keys_present", schemes.values.all? { |scheme| scheme[:keys_present] }) if schemes.any?
+        record_fact("tacacs.schemes", schemes)
+        record_fact("tacacs.servers", schemes.values.flat_map { |scheme| scheme[:servers] }.uniq)
+        record_fact("tacacs.keys_present", schemes.values.all? { |scheme| scheme[:keys_present] }) if schemes.any?
         { "authentication-server" => "login", "authorization-mode" => "authorization" }.each do |command, fact|
           entries = matching_blocks(/\Aadmin #{command}\b/)
           next if entries.empty?
-          parts = tokens(entries.last)
+          parts = command_tokens(entries.last)
           name = parts[3] if parts.size == 4 && parts[2] == "aaa-server"
           if name && schemes[name] && schemes[name][:servers].any?
-            record("tacacs.#{fact}", true, entries)
+            record_fact("tacacs.#{fact}", true, entries)
           else
-            unknown("tacacs.#{fact}", entries, code: :tacacs_scheme_unresolved)
+            record_unknown_fact("tacacs.#{fact}", entries, code: :tacacs_scheme_unresolved)
           end
         end
         matching_blocks(/\Aadmin user\s+/).each do |section|
-          owner = tokens(section)[2]
+          owner = command_tokens(section)[2]
           passwords = matching_blocks(/\Apassword\b/, section.children)
           record_credential(owner, "local_user", "unknown", nil, section) if passwords.empty?
-          passwords.each { |entry| stored_secret(owner, "local_user", entry) }
+          passwords.each { |entry| record_stored_credential(owner, "local_user", entry) }
         end
       end
 
       # 编码格式的存储语义未经确认时保持未知，不能猜测为明文。
-      def secret_format(value) = value.start_with?("$") ? "unknown" : "plain"
+      def credential_storage_format(value) = value.start_with?("$") ? "unknown" : "plain"
 
       # 仅记录已配置秘密值的存储属性。
-      def stored_secret(owner, kind, entry)
-        parts = tokens(entry).drop(1)
+      def record_stored_credential(owner, kind, entry)
+        parts = command_tokens(entry).drop(1)
         valid = parts.size == 1 && !%w[cipher hash plain].include?(parts.first) || parts.size == 2 && %w[cipher hash plain].include?(parts.first)
         unless valid && !parts.last.to_s.empty?
-          @facts.incomplete!(code: :invalid_credential_statement, lines: [ entry.line ])
+          @fact_builder.mark_incomplete!(code: :invalid_credential_statement, lines: [ entry.line ])
           record_credential(owner, kind, "unknown", nil, entry)
           return false
         end
-        format, secret = parts.size == 2 && %w[cipher hash plain].include?(parts.first) ? parts : [ secret_format(parts.first.to_s), parts.first ]
+        format, secret = parts.size == 2 && %w[cipher hash plain].include?(parts.first) ? parts : [ credential_storage_format(parts.first.to_s), parts.first ]
         record_credential(owner, kind, format, secret, entry)
         true
       end
 
       # 切分含引号的命令值，不将其作为 Ruby 代码解释。
-      def tokens(entry)
+      def command_tokens(entry)
         @tokens[entry.index] ||= Shellwords.shellsplit(entry.text)
       rescue ArgumentError
-        @facts.incomplete!(code: :invalid_quoted_statement, lines: [ entry.line ])
+        @fact_builder.mark_incomplete!(code: :invalid_quoted_statement, lines: [ entry.line ])
         cursor.mark(entry.index, state: :unsupported)
         @tokens[entry.index] = []
       end
 
       # 校验可选参数，避免接受任意尾随命令片段。
-      def pairs(parts, flags:, keys:)
+      def parse_keyword_options(parts, flags:, keys:)
         values = {}
         until parts.empty?
           key = parts.shift
@@ -261,12 +314,12 @@ module Baseline
       end
 
       # 将命名主机或网络对象归一化为地址区间。
-      def host_networks(parts)
+      def parse_host_networks(parts)
         return [ "0.0.0.0/0" ] if parts == [ "any" ]
         if parts.size == 3 && parts.first == "range"
           first, last = parts.drop(1).map { |value| IPAddr.new(value) }
           raise ArgumentError unless first.ipv4? && last.ipv4? && first.prefix == 32 && last.prefix == 32 && first.to_i <= last.to_i
-          Acl.network_prefixes([ [ first.to_i, last.to_i ] ])
+          Acl.cidrs_from_ranges([ [ first.to_i, last.to_i ] ])
         elsif parts.size == 1 || parts.size == 2
           value = IPAddr.new(parts.join("/"))
           raise ArgumentError unless value.ipv4?

data/lib/baseline/huawei/parser.rb

@@ -9,40 +9,42 @@ module Baseline
       private
 
       # 匹配当前平台显式启用 SSH 的命令。
-      def ssh_enable = /\Astelnet server enable\z/
+      def ssh_enable_pattern = /\Astelnet server enable\z/
       # 匹配当前平台显式禁用 SSH 的命令。
-      def ssh_disable = /\A(?:undo stelnet server enable|stelnet server disable)\z/
+      def ssh_disable_pattern = /\A(?:undo stelnet server enable|stelnet server disable)\z/
       # 匹配当前平台 TACACS 配置块的根语句。
-      def tacacs_section = /\Ahwtacacs-server template\s+/
+      def tacacs_section_pattern = /\Ahwtacacs-server template\s+/
       # 匹配认证、授权或计费服务器声明。
-      def tacacs_server = /\Ahwtacacs-server (?:authentication|authorization|accounting)\s+(\S+)/
+      def tacacs_server_pattern = /\Ahwtacacs-server (?:authentication|authorization|accounting)\s+(\S+)/
+      # 完整选择服务器命令族，缺失地址也必须保留为损坏证据。
+      def tacacs_server_family_pattern = /\A(?:undo )?hwtacacs-server (?:authentication|authorization|accounting)(?:\s|\z)/
       # 匹配已配置 TACACS 密钥的存储格式。
-      def tacacs_key = /\Ahwtacacs-server (shared)-key (cipher|simple) (.+)\z/
+      def tacacs_key_pattern = /\Ahwtacacs-server (shared)-key (cipher|simple) (.+)\z/
       # 要求具备当前平台 TACACS 方案使用的全部密钥角色。
       def tacacs_keys_complete?(types) = types.include?("shared")
       # 返回当前平台修改 SNMP 监听端口的命令模式。
       def snmp_port_command = "snmp-agent udp-port"
       # 从实际所属配置作用域中选取 AAA 声明。
-      def aaa_entries = matching_blocks(/\Aaaa\z/).flat_map(&:children)
+      def aaa_configuration_entries = matching_blocks(/\Aaaa\z/).flat_map(&:children)
       # 解析认证域引用及其服务器组。
       def authentication_domains
         name = last_configured_value(/\Adomain\s+(\S+)\s+admin\z/)
         unless name
-          %w[login authorization accounting].each { |kind| unknown("tacacs.#{kind}", code: :authentication_domain_unknown) }
+          %w[login authorization accounting].each { |kind| record_unknown_fact("tacacs.#{kind}", code: :authentication_domain_unknown) }
           return []
         end
-        aaa_entries.select { |entry| entry.text == "domain #{name}" }
+        aaa_configuration_entries.select { |entry| entry.text == "domain #{name}" }
       end
 
       # 解析 VRP 认证域引用，避免将 VRP 语法应用到 Comware。
-      def vrp_tacacs_references(kind, domains)
+      def domain_tacacs_references(kind, domains)
         domains.filter_map do |domain|
           template = last_configured_value(/\Ahwtacacs-server\s+(\S+)\z/, domain.children)
           scheme = last_configured_value(/\A#{kind}-scheme\s+(\S+)\z/, domain.children)
           next unless template && scheme
-          definition = aaa_entries.find { |entry| entry.text == "#{kind}-scheme #{scheme}" }
+          definition = aaa_configuration_entries.find { |entry| entry.text == "#{kind}-scheme #{scheme}" }
           unless definition
-            unknown("tacacs.#{kind == 'authentication' ? 'login' : kind}", [ domain ], code: :tacacs_scheme_unresolved)
+            record_unknown_fact("tacacs.#{kind == 'authentication' ? 'login' : kind}", [ domain ], code: :tacacs_scheme_unresolved)
             next
           end
           template if last_configured_value(/\A#{kind}-mode\s+(.+)\z/, definition.children).to_s.split.first == "hwtacacs"
@@ -50,8 +52,8 @@ module Baseline
       end
 
       # 提取本地账号角色及凭据存储属性。
-      def accounts
-        matching_blocks(/\Alocal-user\s+\S+\s+password\b/, aaa_entries).each do |entry|
+      def parse_local_accounts
+        matching_blocks(/\Alocal-user\s+\S+\s+password\b/, aaa_configuration_entries).each do |entry|
           match = /\Alocal-user\s+(\S+)\s+password\s+(cipher|irreversible-cipher|simple)\s+(.+)\z/.match(entry.text)
           if match
             record_credential(match[1], "local_user", match[2], match[3], entry)

data/lib/baseline/{quoted_document.rb → multiline_document.rb}

@@ -4,7 +4,7 @@ require_relative "document"
 
 module Baseline
   # 多行引号内容始终作为数据处理，即使正文看起来像全局命令。
-  class QuotedDocument < Document
+  class MultilineDocument < Document
     protected
 
     # 区分配置结构行与引号、横幅中的文本内容。

data/lib/baseline/palo_alto/command_index.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module Baseline
+  module PaloAlto
+    # 按词元建立前缀索引，使账号、服务和配置文件查询不反复扫描整个导出。
+    class CommandIndex
+      # 深层查询扫描候选行，避免无效标量尾部扩大索引；完整词元仍保留供语法校验。
+      MAX_INDEX_DEPTH = 7
+      Node = Struct.new(:children, :rows)
+      private_constant :MAX_INDEX_DEPTH, :Node
+
+      # 来源顺序与重复声明均保留，标量调用者仍可选择最后一行。
+      def initialize(rows)
+        @root = Node.new({}, rows.dup.freeze)
+        nodes = [ @root ]
+        rows.each do |row|
+          node = @root
+          row.fetch(:tokens).take(MAX_INDEX_DEPTH).each do |token|
+            node = node.children[token] ||= begin
+              child = Node.new({}, [])
+              nodes << child
+              child
+            end
+            node.rows << row
+          end
+        end
+        nodes.each { |node| node.children.freeze; node.rows.freeze; node.freeze }
+        freeze
+      end
+
+      # 按完整词元匹配前缀，避免同名账号、层级或包含空格的值串扰。
+      def matching_prefix(prefix)
+        node = @root
+        prefix.take(MAX_INDEX_DEPTH).each do |token|
+          node = node.children[token]
+          return [] unless node
+        end
+        return node.rows if prefix.size <= MAX_INDEX_DEPTH
+
+        node.rows.select { |row| row.fetch(:tokens).take(prefix.size) == prefix }.freeze
+      end
+
+      # 索引持有词元，默认调试输出不能展开配置或凭据。
+      def inspect = "#<#{self.class}>"
+    end
+    private_constant :CommandIndex
+  end
+end

data/lib/baseline/palo_alto/document.rb

@@ -1,16 +1,16 @@
 # frozen_string_literal: true
 
-require_relative "../quoted_document"
+require_relative "../multiline_document"
 
 module Baseline
   module PaloAlto
     # PAN-OS 的 set 导出可能包含引号包裹的多行证书与描述。
-    class Document < QuotedDocument
+    class Document < MultilineDocument
       protected
 
       # 已建模的多行值不能被误判为配置缺失；证书正文不参与语义分析。
       def multiline_fact?(text)
-        /\Aset (?:deviceconfig system (?:hostname|service|permitted-ip|ntp-servers|snmp-setting|authentication-profile|route service)\b|shared (?:server-profile tacplus|authentication-profile|authentication-sequence|log-settings syslog)\b|mgt-config users\b|network profiles interface-management-profile\b)/.match?(text)
+        /\Aset (?:deviceconfig system (?:hostname|service|permitted-ip|ntp-servers|snmp-setting|authentication-profile|route service)\b|shared (?:server-profile tacplus|authentication-profile|authentication-sequence|log-settings syslog)\b|mgt-config users\b|network (?:profiles interface-management-profile|interface)\b)/.match?(text)
       end
     end
   end