baseline-rb 0.2.1 → 0.3.0

data/lib/baseline/palo_alto/parser.rb

@@ -4,11 +4,22 @@ require_relative "../parser"
 
 require "shellwords"
 require_relative "document"
+require_relative "command_index"
 
 module Baseline
   module PaloAlto
     # 将 PAN-OS set 语法归纳为与配置块平台一致的事实。
     class Parser < Baseline::Parser
+      # 原生管理端点没有 VTY 模型；未建模能力保留未知，不改变规则适用范围。
+      UNSUPPORTED_FACTS = {
+        "ssh.versions" => :ssh_version_unmodeled,
+        "ssh.vty_ssh_only" => :native_management_endpoint,
+        "ssh.vty_aaa" => :native_management_endpoint,
+        "tacacs.authorization" => :platform_semantics_unresolved,
+        "tacacs.accounting" => :platform_semantics_unresolved
+      }.freeze
+      PARTIAL_FACTS = { "services" => :service_states_partially_modeled }.freeze
+
       MANAGEMENT_SERVICES = %w[ssh telnet http https].freeze
       RELEVANT = /\Aset (?:deviceconfig system |network (?:profiles interface-management-profile |interface )|shared (?:server-profile tacplus |authentication-profile |authentication-sequence |log-settings syslog )|mgt-config users )/
 
@@ -18,25 +29,31 @@ module Baseline
       def document_class = Document
       # 匹配当前平台显式声明的主机名。
       def hostname_pattern = /\Aset deviceconfig system hostname\s+(\S+)\z/
+      # set 语法使用独立的设备身份命令族。
+      def hostname_family_pattern = /\Aset deviceconfig system hostname(?:\s|\z)/
 
       # 仅对管理配置子集分词一次，不处理无关的安全规则。
       def prepare_configuration
-        @statements = roots.filter_map do |entry|
+        statements = roots.filter_map do |entry|
           next unless RELEVANT.match?(entry.text)
           { entry: entry, tokens: Shellwords.shellsplit(entry.text).drop(1) }
         rescue ArgumentError
-          @facts.incomplete!(code: :invalid_set_statement, lines: [ entry.line ])
+          @fact_builder.mark_incomplete!(code: :invalid_set_statement, lines: [ entry.line ])
           nil
         end
-        @interface_profiles = rows("network", "profiles", "interface-management-profile").group_by { |row| row[:tokens][3] }
+        @command_index = CommandIndex.new(statements)
+        @interface_profiles = statements_with_prefix("network", "profiles", "interface-management-profile").group_by { |row| row[:tokens][3] }
         @unresolved_profile_bindings = false
-        @profile_bindings = rows("network", "interface").select do |row|
+        # 同一接口作用域只保留最后绑定，其他接口继续独立参与管理端点归约。
+        bindings = statements_with_prefix("network", "interface").select { |row| row[:tokens].include?("interface-management-profile") }
+          .group_by { |row| row[:tokens].take(row[:tokens].index("interface-management-profile")) }.values.map(&:last)
+        @profile_bindings = bindings.select do |row|
           index = row[:tokens].index("interface-management-profile")
           next false unless index
           valid = row[:tokens].size == index + 2 && !row[:tokens].last.empty?
           unless valid
             @unresolved_profile_bindings = true
-            @facts.incomplete!(code: :invalid_management_profile_binding, lines: [ row[:entry].line ])
+            @fact_builder.mark_incomplete!(code: :invalid_management_profile_binding, lines: [ row[:entry].line ])
           end
           valid
         end
@@ -44,20 +61,20 @@ module Baseline
       end
 
       # 覆盖所有已配置的管理端点，包括数据接口。
-      def management
-        services = (MANAGEMENT_SERVICES + [ "snmp" ]).to_h { |name| [ name, service_state(name) ] }
-        record("ssh.enabled", services["ssh"], service_entries([ "ssh" ]))
-        record("services", services.slice("telnet", "http", "https"), service_entries(%w[telnet http https]))
-        record("snmp.enabled", services["snmp"], service_entries([ "snmp" ]))
-        permitted_sources("management.acl", MANAGEMENT_SERVICES)
-        permitted_sources("snmp.acl", [ "snmp" ])
+      def parse_management
+        service_states = (MANAGEMENT_SERVICES + [ "snmp" ]).to_h { |name| [ name, service_state(name) ] }
+        record_fact("ssh.enabled", service_states["ssh"], service_entries([ "ssh" ]))
+        record_fact("services", service_states.slice("telnet", "http", "https"), service_entries(%w[telnet http https]))
+        record_fact("snmp.enabled", service_states["snmp"], service_entries([ "snmp" ]))
+        record_permitted_sources("management.acl", MANAGEMENT_SERVICES)
+        record_permitted_sources("snmp.acl", [ "snmp" ])
       end
 
       # MGT 服务标志缺失时保持未知；明确启用的端点可证明服务已启用。
       def service_state(name)
-        disabled = boolean(%w[deviceconfig system service] + [ "disable-#{name}" ])
+        disabled = configured_boolean(%w[deviceconfig system service] + [ "disable-#{name}" ])
         global = disabled.nil? ? nil : !disabled
-        values = @active_profiles.map { |profile| profile_service(profile, name) }
+        values = @active_profiles.map { |profile| profile_service_state(profile, name) }
         return true if global == true || values.include?(true)
         return false if global == false && values.all?(false)
 
@@ -67,37 +84,37 @@ module Baseline
       # 保留参与跨端点服务事实归纳的显式声明。
       def service_entries(names)
         names.flat_map do |name|
-          rows(*(%w[deviceconfig system service] + [ "disable-#{name}" ])) + @active_profiles.flat_map do |profile|
-            rows("network", "profiles", "interface-management-profile", profile, name)
+          statements_with_prefix(*(%w[deviceconfig system service] + [ "disable-#{name}" ])) + @active_profiles.flat_map do |profile|
+            statements_with_prefix("network", "profiles", "interface-management-profile", profile, name)
           end
         end.map { |row| row[:entry] }
       end
 
       # 仅解释命名接口配置文件中显式声明的服务。
-      def profile_service(profile, name)
+      def profile_service_state(profile, name)
         return unless @interface_profiles.key?(profile)
         prefix = [ "network", "profiles", "interface-management-profile", profile, name ]
-        value = boolean(prefix)
+        value = configured_boolean(prefix)
         return value unless value.nil?
-        return if rows(*prefix).any?
-        return false if value.nil? && @facts.complete?
+        return if statements_with_prefix(*prefix).any?
+        return false if value.nil? && @fact_builder.complete?
 
         nil
       end
 
       # 端点的原生允许列表适用于该端点所有已启用服务。
-      def permitted_sources(fact, services)
-        global = services.map { |name| boolean(%w[deviceconfig system service] + [ "disable-#{name}" ]) }
+      def record_permitted_sources(fact, service_names)
+        global = service_names.map { |name| configured_boolean(%w[deviceconfig system service] + [ "disable-#{name}" ]) }
         prefixes = global.all?(true) ? [] : [ %w[deviceconfig system permitted-ip] ]
         unresolved = @unresolved_profile_bindings
         @active_profiles.each do |profile|
-          enabled = services.map { |name| profile_service(profile, name) }
+          enabled = service_names.map { |name| profile_service_state(profile, name) }
           unresolved ||= enabled.include?(nil)
           prefixes << [ "network", "profiles", "interface-management-profile", profile, "permitted-ip" ] if enabled.include?(true)
         end
         entries = []
         sources = prefixes.flat_map do |prefix|
-          matches = rows(*prefix)
+          matches = statements_with_prefix(*prefix)
           entries.concat(matches.map { |row| row[:entry] })
           matches.empty? ? [ "0.0.0.0/0" ] : matches.map do |row|
             tokens = row[:tokens].drop(prefix.size)
@@ -117,41 +134,34 @@ module Baseline
           end
         end.compact
         bound = !sources.include?("0.0.0.0/0")
-        @facts.direct_acl(fact: fact, sources: unresolved ? nil : sources, bound: bound, lines: entries.map(&:line))
-        unknown("#{fact}.bound", code: :management_profile_unresolved) if unresolved
+        @fact_builder.record_source_restriction(fact: fact, sources: unresolved ? nil : sources, bound: bound, lines: entries.map(&:line))
+        record_unknown_fact("#{fact}.bound", code: :management_profile_unresolved) if unresolved
         cursor.capture_many(entries.select { |entry| cursor.parsed?(entry.index) }, data: sources, path: [ "facts", "#{fact}.sources" ]) unless unresolved
       end
 
-      # 采集明确启用或禁用的管理服务。
-      def services
-        ntp
-        syslog
-        snmp
-      end
-
       # 认证要求必须覆盖全部已配置服务器，不能由任意一台满足来证明。
-      def ntp
-        entries = rows("deviceconfig", "system", "ntp-servers")
+      def parse_ntp
+        entries = statements_with_prefix("deviceconfig", "system", "ntp-servers")
         servers = entries.group_by { |row| row[:tokens][3] }.filter_map do |name, definitions|
           prefix = [ "deviceconfig", "system", "ntp-servers", name ]
-          address = endpoint(prefix + [ "ntp-server-address" ])
+          address = configured_server_address(prefix + [ "ntp-server-address" ])
           unless address && %w[primary-ntp-server secondary-ntp-server].include?(name)
-            unknown("ntp.servers", definitions.map { |row| row[:entry] }, code: :ntp_server_unresolved)
-            unknown("ntp.authentication", definitions.map { |row| row[:entry] }, code: :ntp_server_unresolved)
+            record_unknown_fact("ntp.servers", definitions.map { |row| row[:entry] }, code: :ntp_server_unresolved)
+            record_unknown_fact("ntp.authentication", definitions.map { |row| row[:entry] }, code: :ntp_server_unresolved)
             next
           end
-          { address: address, authenticated: ntp_authentication(prefix) }
+          { address: address, authenticated: ntp_authentication_state(prefix) }
         end
-        record("ntp.servers", servers.map { |server| server[:address] }.uniq, entries.map { |row| row[:entry] })
+        record_fact("ntp.servers", servers.map { |server| server[:address] }.uniq, entries.map { |row| row[:entry] })
         if servers.any? && servers.none? { |server| server[:authenticated].nil? }
-          record("ntp.authentication", servers.all? { |server| server[:authenticated] }, entries.map { |row| row[:entry] })
+          record_fact("ntp.authentication", servers.all? { |server| server[:authenticated] }, entries.map { |row| row[:entry] })
         end
-        record_scalar("ntp.source", %w[deviceconfig system route service ntp source interface])
+        record_configured_scalar("ntp.source", %w[deviceconfig system route service ntp source interface])
       end
 
       # 仅完整的认证声明才能证明所有服务器均满足认证要求。
-      def ntp_authentication(prefix)
-        entries = rows(*(prefix + [ "authentication-type" ]))
+      def ntp_authentication_state(prefix)
+        entries = statements_with_prefix(*(prefix + [ "authentication-type" ]))
         options = entries.map { |row| row[:tokens].drop(prefix.size + 1) }.uniq
         return if options.empty?
         return false if options == [ [ "none" ] ]
@@ -162,128 +172,126 @@ module Baseline
             key[3] == "authentication-key" && !key[4].empty? && id.size == 3 && /\A\d+\z/.match?(id[2]) && id[2].to_i.between?(1, 65_534)
           return true
         end
-        unknown("ntp.authentication", entries.map { |row| row[:entry] }, code: :unsupported_ntp_authentication)
+        record_unknown_fact("ntp.authentication", entries.map { |row| row[:entry] }, code: :unsupported_ntp_authentication)
         nil
       end
 
       # 配置的采集端地址与运行时日志转发成功是两类事实。
-      def syslog
-        entries = rows("shared", "log-settings", "syslog").select { |row| row[:tokens][4] == "server" }
+      def parse_syslog
+        entries = statements_with_prefix("shared", "log-settings", "syslog").select { |row| row[:tokens][4] == "server" }
         servers = entries.group_by { |row| [ row[:tokens][3], row[:tokens][5] ] }.values.filter_map do |definitions|
           address = definitions.reverse.find { |row| row[:tokens][6] == "server" }
-          value = address && endpoint(address[:tokens].take(7))
-          unknown("syslog.servers", definitions.map { |row| row[:entry] }, code: :syslog_server_unresolved) unless value
+          value = address && configured_server_address(address[:tokens].take(7))
+          record_unknown_fact("syslog.servers", definitions.map { |row| row[:entry] }, code: :syslog_server_unresolved) unless value
           value
         end
-        record("syslog.servers", servers.uniq, entries.map { |row| row[:entry] })
-        record_scalar("syslog.source", %w[deviceconfig system route service syslog source interface])
+        record_fact("syslog.servers", servers.uniq, entries.map { |row| row[:entry] })
+        record_configured_scalar("syslog.source", %w[deviceconfig system route service syslog source interface])
       end
 
       # 轮询用户、团体字与出站 SNMP Trap 配置相互独立。
-      def snmp
+      def parse_snmp
         prefix = %w[deviceconfig system snmp-setting access-setting version]
-        versions = rows(*prefix).map { |row| row[:tokens][prefix.size] }.compact.uniq
-        record("snmp.versions", versions)
-        communities = rows(*(prefix + %w[v2c snmp-community-string])).filter_map do |row|
+        versions = statements_with_prefix(*prefix).map { |row| row[:tokens][prefix.size] }.compact.uniq
+        record_fact("snmp.versions", versions)
+        communities = statements_with_prefix(*(prefix + %w[v2c snmp-community-string])).filter_map do |row|
           unless row[:tokens].size == prefix.size + 3 && !row[:tokens].last.empty?
-            @facts.incomplete!(code: :invalid_set_statement, lines: [ row[:entry].line ])
+            @fact_builder.mark_incomplete!(code: :invalid_set_statement, lines: [ row[:entry].line ])
             next
           end
-          record_credential("snmp-community", "snmp", secret_format(row[:tokens].last), row[:tokens].last, row[:entry])
+          record_credential("snmp-community", "snmp", credential_storage_format(row[:tokens].last), row[:tokens].last, row[:entry])
           { write: false, line: row[:entry].line }
         end
         users_prefix = prefix + %w[v3 users]
-        users = rows(*users_prefix).group_by { |row| row[:tokens][users_prefix.size] }.filter_map do |name, entries|
+        users = statements_with_prefix(*users_prefix).group_by { |row| row[:tokens][users_prefix.size] }.filter_map do |name, entries|
           next unless name
           user = { name: name, auth: false, priv: false, write: false, line: entries.first[:entry].line }
           { "authpwd" => :auth, "privpwd" => :priv }.each do |field, key|
             row = entries.reverse.find { |entry| entry[:tokens][users_prefix.size + 1] == field }
             next unless row
             unless row[:tokens].size == users_prefix.size + 3 && !row[:tokens].last.empty?
-              @facts.incomplete!(code: :invalid_set_statement, lines: [ row[:entry].line ])
+              @fact_builder.mark_incomplete!(code: :invalid_set_statement, lines: [ row[:entry].line ])
               next
             end
             user[key] = !row[:tokens].last.empty?
-            record_credential("snmp:#{name}", "snmp_user", secret_format(row[:tokens].last), row[:tokens].last, row[:entry])
+            record_credential("snmp:#{name}", "snmp_user", credential_storage_format(row[:tokens].last), row[:tokens].last, row[:entry])
           end
           user
         end
-        @facts.snmp(communities: communities, users: users)
+        @fact_builder.record_snmp_access(communities: communities, users: users)
         if (versions - %w[v2c v3]).any? || versions.size > 1
-          unknown_snmp_access(rows(*prefix).map { |row| row[:entry] }, code: :unsupported_snmp_version)
+          record_unknown_snmp_access(statements_with_prefix(*prefix).map { |row| row[:entry] }, code: :unsupported_snmp_version)
         end
       end
 
       # 将选中的登录配置或有序认证序列解析为 TACACS 服务器。
-      def authentication
-        server_rows = rows("shared", "server-profile", "tacplus")
+      def parse_authentication
+        server_rows = statements_with_prefix("shared", "server-profile", "tacplus")
         schemes = server_rows.group_by { |row| row[:tokens][3] }.to_h do |name, entries|
           servers = entries.select { |row| row[:tokens][4] == "server" }.group_by { |row| row[:tokens][5] }
           addresses = servers.values.filter_map do |server|
             address = server.reverse.find { |row| row[:tokens][6] == "address" }
-            value = address && endpoint(address[:tokens].take(7))
-            unknown("tacacs.servers", server.map { |row| row[:entry] }, code: :tacacs_server_unresolved) unless value
+            value = address && configured_server_address(address[:tokens].take(7))
+            record_unknown_fact("tacacs.servers", server.map { |row| row[:entry] }, code: :tacacs_server_unresolved) unless value
             value
           end
-          unknown("tacacs.servers", entries.map { |row| row[:entry] }, code: :tacacs_server_unresolved) if servers.empty?
+          record_unknown_fact("tacacs.servers", entries.map { |row| row[:entry] }, code: :tacacs_server_unresolved) if servers.empty?
           keys = servers.values.map do |server|
             secret = server.reverse.find { |row| row[:tokens][6] == "secret" }
-            value = secret && scalar(secret[:tokens].take(7))
-            record_credential("tacacs:#{name}", "tacacs", secret_format(value), value, secret[:entry]) if value
+            value = secret && configured_scalar(secret[:tokens].take(7))
+            record_credential("tacacs:#{name}", "tacacs", credential_storage_format(value), value, secret[:entry]) if value
             !value.to_s.empty?
           end
           [ name, { servers: addresses, keys_present: keys.any? && keys.all?, line: entries.first[:entry].line } ]
         end
-        record("tacacs.schemes", schemes)
-        record("tacacs.servers", schemes.values.flat_map { |scheme| scheme[:servers] }.uniq)
-        record("tacacs.keys_present", schemes.values.all? { |scheme| scheme[:keys_present] }) if schemes.any?
-        selected = scalar(%w[deviceconfig system authentication-profile])
-        login = selected ? tacacs_profile(selected, schemes) : false
-        login.nil? ? unknown("tacacs.login", code: :tacacs_scheme_unresolved) : record("tacacs.login", login)
-        # PAN-OS 角色映射与命令计费不能套用路由器式 AAA 开关语义。
-        %w[authorization accounting].each { |kind| unknown("tacacs.#{kind}", code: :platform_semantics_unresolved) }
-        accounts
+        record_fact("tacacs.schemes", schemes)
+        record_fact("tacacs.servers", schemes.values.flat_map { |scheme| scheme[:servers] }.uniq)
+        record_fact("tacacs.keys_present", schemes.values.all? { |scheme| scheme[:keys_present] }) if schemes.any?
+        selected = configured_scalar(%w[deviceconfig system authentication-profile])
+        login = selected ? tacacs_login_state(selected, schemes) : false
+        login.nil? ? record_unknown_fact("tacacs.login", code: :tacacs_scheme_unresolved) : record_fact("tacacs.login", login)
+        parse_local_accounts
       end
 
       # 认证序列具有顺序；后备 TACACS 不能视为首选 TACACS 登录。
-      def tacacs_profile(name, schemes)
+      def tacacs_login_state(name, schemes)
         prefix = [ "shared", "authentication-profile", name, "method" ]
-        methods = rows(*prefix)
+        methods = statements_with_prefix(*prefix)
         if methods.empty?
-          sequence = rows("shared", "authentication-sequence", name, "authentication-profiles").last
+          sequence = statements_with_prefix("shared", "authentication-sequence", name, "authentication-profiles").last
           return unless sequence
           names = sequence[:tokens].drop(4).reject { |token| %w[[ ]].include?(token) }
           return if names.empty? || names.first == name
-          return tacacs_profile_definition(names.first, schemes)
+          return authentication_profile_tacacs_state(names.first, schemes)
         end
-        tacacs_profile_definition(name, schemes)
+        authentication_profile_tacacs_state(name, schemes)
       end
 
       # 选中的 TACACS 配置必须至少解析出一台具有地址的服务器。
-      def tacacs_profile_definition(name, schemes)
+      def authentication_profile_tacacs_state(name, schemes)
         prefix = [ "shared", "authentication-profile", name, "method" ]
-        methods = rows(*prefix)
+        methods = statements_with_prefix(*prefix)
         return if methods.empty?
         kinds = methods.map { |row| row[:tokens][4] }.uniq
         return unless kinds.one?
         return false if %w[none local-database radius ldap kerberos saml-idp cloud].include?(kinds.first)
         return unless kinds.first == "tacplus"
-        target = scalar(prefix + %w[tacplus server-profile])
+        target = configured_scalar(prefix + %w[tacplus server-profile])
         return unless target && schemes[target] && schemes[target][:servers].any?
 
         true
       end
 
       # 仅存储凭据元数据，导出的加密值不进入报告。
-      def accounts
-        rows("mgt-config", "users").group_by { |row| row[:tokens][2] }.each do |name, entries|
+      def parse_local_accounts
+        statements_with_prefix("mgt-config", "users").group_by { |row| row[:tokens][2] }.each do |name, entries|
           row = entries.reverse.find { |entry| entry[:tokens][3] == "phash" }
           unless row
-            external_profile = scalar([ "mgt-config", "users", name, "authentication-profile" ])
+            external_profile = configured_scalar([ "mgt-config", "users", name, "authentication-profile" ])
             record_credential(name, "local_user", "unknown", nil, entries.first[:entry]) unless external_profile && !external_profile.empty?
             next
           end
-          secret = scalar(row[:tokens].take(4))
+          secret = configured_scalar(row[:tokens].take(4))
           format = if /\A\$(?:1|5|6)\$[^$]+\$[^$]+\z/.match?(secret.to_s)
             secret.start_with?("$1$") ? "5" : "hash"
           else
@@ -294,45 +302,45 @@ module Baseline
       end
 
       # 识别 PAN-OS 带标记的加密 set 值；其余情况保留明文风险。
-      def secret_format(value) = value.start_with?("-AQ", "-AR") ? "cipher" : "plain"
+      def credential_storage_format(value) = value.start_with?("-AQ", "-AR") ? "cipher" : "plain"
 
       # 按词元前缀选择归一化后的 PAN-OS set 命令行。
-      def rows(*prefix)
-        @statements.select { |row| row[:tokens].take(prefix.size) == prefix }
+      def statements_with_prefix(*prefix)
+        @command_index.matching_prefix(prefix)
       end
 
       # 地址仅接受 IP 或 DNS 名称，不接受不完整转义或任意文本。
-      def endpoint(prefix)
-        value = scalar(prefix)
+      def configured_server_address(prefix)
+        value = configured_scalar(prefix)
         return if value.nil?
         return value if server_address?(value)
 
-        @facts.incomplete!(code: :invalid_server_address, lines: rows(*prefix).map { |row| row[:entry].line })
+        @fact_builder.mark_incomplete!(code: :invalid_server_address, lines: statements_with_prefix(*prefix).map { |row| row[:entry].line })
         nil
       end
 
       # 显式标志格式错误时，不能用平台默认值替代。
-      def boolean(prefix)
-        value = scalar(prefix)
+      def configured_boolean(prefix)
+        value = configured_scalar(prefix)
         return if value.nil?
         return value == "yes" if %w[yes no].include?(value)
 
-        @facts.incomplete!(code: :invalid_set_statement, lines: rows(*prefix).map { |row| row[:entry].line })
+        @fact_builder.mark_incomplete!(code: :invalid_set_statement, lines: statements_with_prefix(*prefix).map { |row| row[:entry].line })
         nil
       end
 
       # 标量语法与事实来源共享同一条最终声明。
-      def record_scalar(path, prefix)
-        row = rows(*prefix).last
-        record(path, scalar(prefix), row ? [ row[:entry] ] : [])
+      def record_configured_scalar(path, prefix)
+        row = statements_with_prefix(*prefix).last
+        record_fact(path, configured_scalar(prefix), row ? [ row[:entry] ] : [])
       end
 
       # 严格校验词元数量，避免尾随内容使错误配置被误判为已知事实。
-      def scalar(prefix)
-        row = rows(*prefix).last
+      def configured_scalar(prefix)
+        row = statements_with_prefix(*prefix).last
         return unless row
         unless row[:tokens].size == prefix.size + 1
-          @facts.incomplete!(code: :invalid_set_statement, lines: [ row[:entry].line ])
+          @fact_builder.mark_incomplete!(code: :invalid_set_statement, lines: [ row[:entry].line ])
           return
         end