baseline-rb 0.2.1 → 0.3.1

data/lib/baseline/comware/parser.rb

@@ -9,42 +9,42 @@ module Baseline
       private
 
       # 解析管理访问暴露检查使用的有序 ACL 定义。
-      def access_lists
+      def parse_access_lists
         matching_blocks(/\Aacl\s+/).each do |section|
           # IPv6 ACL 不能误建为名为 ipv6 的 IPv4 ACL，也不能覆盖其别名。
           if /\Aacl\s+ipv6\b/.match?(section.text)
-            unknown("ipv6.acls", [ section ], code: :unsupported_acl_family)
+            record_unknown_fact("ipv6.acls", [ section ], code: :unsupported_acl_family)
             next
           end
           match = /\Aacl\s+(?:number\s+|basic\s+|advanced\s+)?(?:name\s+)?(\S+)(?:\s+name\s+(\S+))?(?:\s+.*)?\z/.match(section.text)
           next unless match
           register_acl(match[2] || match[1], section.children, source: section, aliases: [ match[1] ], supported: !section.text.include?("match-order auto")) do |entry, index|
-            comware_rule(entry, index)
+            parse_acl_rule(entry, index)
           end
         end
       end
 
       # 解析单条有序 Comware ACL 规则及来源限制。
-      def comware_rule(entry, _index)
+      def parse_acl_rule(entry, _index)
         match = /\Arule\s+(\d+)\s+(permit|deny)(?:\s+(.*))?\z/.match(entry.text)
         return unless match
         parts = match[3].to_s.split
         protocol = %w[ip tcp udp icmp].include?(parts.first) ? parts.shift : "ip"
         network = if parts.first == "source"
           parts.shift
-          acl_source_network(parts)
+          parse_acl_source_network(parts)
         else
           "0.0.0.0/0"
         end
         if parts.first == "destination"
           parts.shift
-          return unless acl_source_network(parts) == "0.0.0.0/0"
+          return unless parse_acl_source_network(parts) == "0.0.0.0/0"
         end
         if parts.first == "destination-port"
           return unless %w[tcp udp].include?(protocol)
           parts.shift
           return unless parts.shift == "eq"
-          port = service_port(parts.shift)
+          port = parse_service_port(parts.shift)
           return if port.nil?
         end
         return unless (parts - %w[logging counting]).empty?
@@ -55,60 +55,99 @@ module Baseline
       end
 
       # 根据监听服务、认证方式与 ACL 绑定关系归纳管理访问事实。
-      def management
-        record("ssh.enabled", configured_state(ssh_enable, ssh_disable), matching_blocks(/\A(?:undo )?(?:ssh|stelnet)/))
+      def parse_management
+        record_fact("ssh.enabled", configured_state(ssh_enable_pattern, ssh_disable_pattern), matching_blocks(/\A(?:undo )?(?:ssh|stelnet)/))
         compatible = configured_state(/\Assh server compatible-ssh1x enable\z/, /\A(?:undo ssh server compatible-ssh1x enable|ssh server compatible-ssh1x disable)\z/)
-        record("ssh.versions", compatible.nil? ? nil : compatible ? [ "1", "2" ] : [ "2" ])
-        ssh_acl = last_configured_value(/\Assh server acl(?: ipv4)?\s+(?:name\s+)?(\S+)\z/)
+        record_fact("ssh.versions", compatible.nil? ? nil : compatible ? [ "1", "2" ] : [ "2" ])
+        ssh_acl_entries = matching_blocks(/\A(?:undo )?ssh server acl\b/).reject { |entry| /\A(?:undo )?ssh server acl ipv6\b/.match?(entry.text) }
+        ssh_acl = effective_configured_value(/\Assh server acl(?: ipv4)?\s+(?!name\z|ipv4\z)(?:name\s+)?(\S+)\z/, entries: ssh_acl_entries,
+          family: /\A(?:undo )?ssh server acl\b/, fact: "management.acl", reset: /\Aundo ssh server acl(?: ipv4)?(?: (?:name )?\S+)?\z/)
         defaults = matching_blocks(/\Aline class vty\z/).flat_map(&:children)
         vtys = matching_blocks(/\A(?:line|user-interface) vty\b/).map do |section|
           entries = defaults + section.children
-          { name: section.text, protocols: last_configured_value(/\Aprotocol inbound\s+(.+)\z/, entries)&.split,
-            authentication: last_configured_value(/\Aauthentication-mode\s+(\S+)\z/, entries),
-            acl: last_configured_value(/\Aacl\s+(?:name\s+)?(\S+)(?:\s+inbound)?\z/, entries), line: section.line }
+          acl_entries = entries.reject { |entry| /\A(?:undo )?acl\s+ipv6\b|\A(?:undo )?acl\s+(?:name\s+)?\S+\s+outbound(?:\s|\z)/.match?(entry.text) }
+          { name: section.text, protocols: effective_configured_value(/\Aprotocol inbound\s+((?:all|ssh|stelnet|telnet)(?:\s+(?:ssh|stelnet|telnet))*)\z/, entries: entries,
+              family: /\A(?:undo )?protocol inbound\b/, fact: "ssh.vty_ssh_only", reset: /\Aundo protocol inbound(?:\s+\S+)*\z/)&.split,
+            authentication: effective_configured_value(/\Aauthentication-mode\s+(scheme|aaa|password|none)\z/, entries: entries,
+              family: /\A(?:undo )?authentication-mode\b/, fact: "ssh.vty_aaa", reset: /\Aundo authentication-mode(?: \S+)?\z/),
+            acl: effective_configured_value(/\Aacl\s+(?!name\z)(?:name\s+)?(\S+)(?:\s+inbound)?\z/, entries: acl_entries,
+              family: /\A(?:undo )?acl\b/, fact: "management.acl", reset: /\Aundo acl(?:\s+(?:name\s+)?\S+(?:\s+inbound)?)?\z/), line: section.line }
         end
-        @facts.management(vtys: vtys, ssh_acl: ssh_acl,
+        @fact_builder.record_management_access(vtys: vtys, ssh_acl: ssh_acl,
           ssh_port: listener_port("ssh server port", default: 22, scope: "management.acl"),
           telnet_port: listener_port("telnet server port", default: 23, scope: "management.acl"))
         definitions = { "telnet" => "telnet server", "http" => "ip http", "https" => "ip https", "ftp" => "ftp server", "tftp" => "tftp server" }
-        record("services", definitions.to_h do |name, command|
+        record_fact("services", definitions.to_h do |name, command|
           [ name, configured_state(/\A#{command} enable\z/, /\A(?:undo #{command} enable|#{command} disable)\z/) ]
         end)
       end
 
-      # 采集明确启用或禁用的管理服务。
-      def services
-        record("ntp.servers", configured_values(/\Antp-service unicast-server\s+(\S+)/), matching_blocks(/\Antp-service unicast-server/))
+      # 提取时间服务器、认证要求与源接口。
+      def parse_ntp
+        ntp_entries = matching_blocks(/\A(?:undo )?ntp-service (?:ipv6 )?unicast-server(?:\s|\z)/)
+        ntp_pattern = /\Antp-service (?:ipv6 )?unicast-server\s+(?:vpn-instance\s+\S+\s+)?((?!(?:vpn-instance|ip|ipv6)(?:\s|\z))\S+)/
+        servers = configured_server_addresses("ntp.servers", ntp_pattern, ntp_entries, negate: "undo") do |text, match|
+          options = parse_server_options(match.post_match, flags: [ "priority" ],
+            integers: { "version" => 1..4, "authentication-keyid" => 1..4_294_967_295, "authkey" => 1..4_294_967_295 },
+            names: [ "vpn-instance" ], interfaces: [ "source-interface" ])
+          vpn = text[/\Antp-service (?:ipv6 )?unicast-server\s+vpn-instance\s+(\S+)/, 1]
+          if options && !(vpn && options.key?("vpn-instance")) && !(options.key?("authkey") && options.key?("authentication-keyid"))
+            [ match[1], vpn || options["vpn-instance"] ]
+          end
+        end
+        record_fact("ntp.servers", servers, ntp_entries)
         record_configured_state("ntp.authentication", /\Antp-service authentication enable\z/, /\Aundo ntp-service authentication enable\z/)
-        record_configured_value("ntp.source", /\Antp-service source(?:-interface)?\s+(\S+)\z/)
-        # 从日志服务器中排除 source 子命令，并保留评估所需的归纳事实。
-        hosts = configured_values(/\Ainfo-center loghost\s+(\S+)/) - [ "source" ]
-        record("syslog.servers", hosts, matching_blocks(/\Ainfo-center loghost/))
-        record_configured_value("syslog.source", /\Ainfo-center loghost source\s+(\S+)\z/)
+        source_entries = matching_blocks(/\A(?:undo )?ntp-service source(?:-interface)?\b/)
+        source = effective_configured_value(/\Antp-service source(?:-interface)?\s+(\S+)\z/, entries: source_entries,
+          family: /\A/, fact: "ntp.source", reset: /\Aundo ntp-service source(?:-interface)?(?:\s+\S+)?\z/)
+        record_fact("ntp.source", source, source_entries.last(1))
+      end
+
+      # 提取日志目标与源接口，厂商命令不进入事实归约层。
+      def parse_syslog
+        log_entries = matching_blocks(/\A(?:undo )?info-center loghost(?:\s|\z)/).reject { |entry| /\A(?:undo )?info-center loghost source(?:\s|\z)/.match?(entry.text) }
+        hosts = configured_server_addresses("syslog.servers", /\Ainfo-center loghost\s+(?:vpn-instance\s+\S+\s+)?(?:ipv6\s+)?((?!(?:vpn-instance|ipv6)(?:\s|\z))\S+)/, log_entries, negate: "undo") do |text, match|
+          [ match[1], text[/\Ainfo-center loghost\s+vpn-instance\s+(\S+)/, 1] ]
+        end
+        record_fact("syslog.servers", hosts, log_entries)
+        source_entries = matching_blocks(/\A(?:undo )?info-center loghost source\b/)
+        source = effective_configured_value(/\Ainfo-center loghost source\s+(\S+)\z/, entries: source_entries,
+          family: /\A/, fact: "syslog.source", reset: /\Aundo info-center loghost source(?:\s+\S+)?\z/)
+        record_fact("syslog.source", source, source_entries.last(1))
+      end
+
+      # 提取轮询权限、用户安全属性及来源限制。
+      def parse_snmp
         enabled = configured_state(/\Asnmp-agent(?:\s|\z)/, /\Aundo snmp-agent\z/)
-        record("snmp.enabled", enabled.nil? && @facts.complete? ? false : enabled)
+        record_fact("snmp.enabled", enabled.nil? && @fact_builder.complete? ? false : enabled)
         versions = last_configured_value(/\Asnmp-agent sys-info version\s+(.+)\z/)&.split
         versions = %w[v1 v2c v3] if versions == [ "all" ]
-        record("snmp.versions", versions)
+        record_fact("snmp.versions", versions)
         communities = matching_blocks(/\Asnmp-agent community\b/).filter_map do |entry|
           match = /\Asnmp-agent community (read|write)\s+(?:(simple|cipher)\s+)?(\S+)(.*)\z/.match(entry.text)
           unless match
-            unknown_snmp_access([ entry ])
+            record_unknown_snmp_access([ entry ])
             next
           end
           record_credential("snmp-community", "snmp", match[2] || "plain", match[3], entry)
           { write: match[1] == "write", acl: match[4][/\bacl\s+(?:name\s+)?(\S+)/, 1], line: entry.line }
         end
-        groups = snmp_groups(matching_blocks(/\Asnmp-agent group v3\s+/)) do |entry|
+        group_entries = matching_blocks(/\Asnmp-agent group\b/).select do |entry|
+          next true if /\Asnmp-agent group v3\s+\S+(?:\s|\z)/.match?(entry.text)
+
+          record_unknown_snmp_access([ entry ], code: :unsupported_snmp_group)
+          false
+        end
+        groups = configured_snmp_groups(group_entries) do |entry|
           settings = entry.text.sub(/\Asnmp-agent group v3\s+\S+\s*/, "")
-          [ entry.text.split[3], { acl: entry.text[/\bacl\s+(?:name\s+)?(\S+)/, 1], line: entry.line, write: snmp_group_write(settings) } ]
+          [ entry.text.split[3], { acl: entry.text[/\bacl\s+(?:name\s+)?(\S+)/, 1], line: entry.line, write: snmp_group_write_state(settings) } ]
         end
-        record("snmp.groups", groups)
+        record_fact("snmp.groups", groups)
         users = {}
         matching_blocks(/\Asnmp-agent usm-user\b/).each do |entry|
           match = /\Asnmp-agent usm-user v3\s+(\S+)(?:\s+(.*))?\z/.match(entry.text)
           unless match
-            unknown_snmp_access([ entry ], code: :unsupported_snmp_user)
+            record_unknown_snmp_access([ entry ], code: :unsupported_snmp_user)
             next
           end
           settings = match[2].to_s
@@ -117,18 +156,18 @@ module Baseline
           first = settings.split.first
           group ||= first unless %w[group authentication-mode privacy-mode acl local engineid].include?(first)
           user[:group] = group if group
-          modes = { auth: snmp_secret(settings, "authentication-mode", algorithms: %w[md5 sha sha2-224 sha2-256 sha2-384 sha2-512]),
-            priv: snmp_secret(settings, "privacy-mode", algorithms: %w[des des56 3des aes128 aes192 aes256]) }
-          snmp_credentials("snmp:#{match[1]}", modes, entry).each { |key, value| user[key] ||= value }
+          modes = { auth: parse_snmp_secret(settings, "authentication-mode", algorithms: %w[md5 sha sha2-224 sha2-256 sha2-384 sha2-512]),
+            priv: parse_snmp_secret(settings, "privacy-mode", algorithms: %w[des des56 3des aes128 aes192 aes256]) }
+          record_snmp_credentials("snmp:#{match[1]}", modes, entry).each { |key, value| user[key] ||= value }
           acl = settings[/\bacl\s+(?:name\s+)?(\S+)/, 1]
           user[:acl] = acl if acl
         end
-        @facts.snmp(communities: communities, users: users.values, groups: groups,
+        @fact_builder.record_snmp_access(communities: communities, users: users.values, groups: groups,
           port: listener_port(snmp_port_command, default: 161, scope: "snmp.acl"))
       end
 
       # Comware、VRP 必须明确授予写视图；引号或未知语法保持未解析。
-      def snmp_group_write(settings)
+      def snmp_group_write_state(settings)
         syntax = /\A(?:(?:authentication|privacy|noauthentication)(?:\s+|\z))?(?:(?:read-view|(?<write>write-view)|notify-view)\s+[^\s"]+\s*|acl(?:\s+ipv6)?(?:\s+name)?\s+[^\s"]+\s*|acl-ipv[46]\s+[^\s"]+\s*)*\z/
         match = syntax.match(settings)
         return unless match
@@ -137,13 +176,13 @@ module Baseline
       end
 
       # 解析实际生效的认证方法及外部服务器引用。
-      def authentication
-        schemes = matching_blocks(tacacs_section).to_h do |section|
-          server_types = matching_blocks(tacacs_server, section.children).group_by { |entry| entry.text.split[1] }
-            .transform_values { |entries| configured_values(tacacs_server, entries) }
+      def parse_authentication
+        schemes = matching_blocks(tacacs_section_pattern).to_h do |section|
+          server_types = matching_blocks(tacacs_server_family_pattern, section.children).group_by { |entry| entry.text.delete_prefix("undo ").split[1] }
+            .transform_values { |entries| configured_server_addresses("tacacs", tacacs_server_pattern, entries, negate: "undo") }
           servers = server_types.values.flatten.uniq
           keys = section.children.filter_map do |entry|
-            match = tacacs_key.match(entry.text)
+            match = tacacs_key_pattern.match(entry.text)
             next unless match
             kind, format, secret = match.captures
             record_credential("tacacs:#{section.text.split.last}", "tacacs", format, secret, entry)
@@ -151,29 +190,34 @@ module Baseline
           end
           [ section.text.split.last, { servers: servers, server_types: server_types, key_types: keys.uniq, line: section.line } ]
         end
-        record("tacacs.schemes", schemes)
-        record("tacacs.servers", schemes.values.flat_map { |entry| entry[:servers] }.uniq)
+        record_fact("tacacs.schemes", schemes)
+        record_fact("tacacs.servers", schemes.values.flat_map { |entry| entry[:servers] }.uniq)
         domains = authentication_domains
         methods = domains.flat_map { |entry| entry.children }
         %w[authentication authorization accounting].each do |kind|
-          relevant = matching_blocks(/\A#{kind}\s+login\b/, methods)
-          relevant = matching_blocks(/\A#{kind}\s+default\b/, methods) if relevant.empty?
+          relevant = matching_blocks(/\A(?:undo )?#{kind}\s+login\b/, methods)
+          relevant = matching_blocks(/\A(?:undo )?#{kind}\s+default\b/, methods) if relevant.empty?
+          relevant = relevant.last(1)
+          if relevant.any? && !/\A#{kind}\s+(?:login|default)\s+(?:(?:hwtacacs-scheme|radius-scheme)\s+\S+(?:\s+(?:local|none))?|local|none)\z/.match?(relevant.first.text)
+            record_unknown_fact("tacacs.#{kind == 'authentication' ? 'login' : kind}", relevant)
+            next
+          end
           refs = relevant.filter_map { |entry| entry.text[/\A#{kind}\s+(?:login|default)\s+hwtacacs-scheme\s+(\S+)/, 1] }
-          refs.concat(vrp_tacacs_references(kind, domains))
+          refs.concat(domain_tacacs_references(kind, domains))
           key = kind == "authentication" ? "login" : kind
           if refs.any? && refs.any? { |name| !schemes.key?(name) || schemes[name][:server_types].fetch(kind, []).empty? }
-            unknown("tacacs.#{key}", relevant, code: :tacacs_scheme_unresolved)
+            record_unknown_fact("tacacs.#{key}", relevant, code: :tacacs_scheme_unresolved)
           else
             used = refs.any?
             if used && key == "login"
-              unknown("tacacs.login", code: :vty_authentication_unknown) if @facts.vtys.empty? || @facts.vtys.any? { |vty| vty[:authentication].nil? }
-              used &&= @facts.vtys.any? && @facts.vtys.all? { |vty| %w[scheme aaa].include?(vty[:authentication]) }
+              record_unknown_fact("tacacs.login", code: :vty_authentication_unknown) if @fact_builder.vtys.empty? || @fact_builder.vtys.any? { |vty| vty[:authentication].nil? }
+              used &&= @fact_builder.vtys.any? && @fact_builder.vtys.all? { |vty| %w[scheme aaa].include?(vty[:authentication]) }
             end
-            record("tacacs.#{key}", used, relevant) if @facts.complete? || used
+            record_fact("tacacs.#{key}", used, relevant) if @fact_builder.complete? || used
           end
         end
-        record("tacacs.keys_present", schemes.values.all? { |entry| tacacs_keys_complete?(entry[:key_types]) }) unless schemes.empty?
-        accounts
+        record_fact("tacacs.keys_present", schemes.values.all? { |entry| tacacs_keys_complete?(entry[:key_types]) }) unless schemes.empty?
+        parse_local_accounts
         matching_blocks(/\A(?:line|user-interface)\b/).each do |section|
           matching_blocks(/\A(?:set authentication )?password\b/, section.children).each do |entry|
             match = /\A(?:set authentication )?password\s+(simple|cipher|hash|irreversible-cipher)\s+(.+)\z/.match(entry.text)
@@ -190,18 +234,18 @@ module Baseline
       def authentication_domains
         name = last_configured_value(/\Adomain default enable\s+(\S+)\z/)
         unless name
-          %w[login authorization accounting].each { |kind| unknown("tacacs.#{kind}", code: :authentication_domain_unknown) }
+          %w[login authorization accounting].each { |kind| record_unknown_fact("tacacs.#{kind}", code: :authentication_domain_unknown) }
           return []
         end
         matching_blocks(/\Adomain #{Regexp.escape(name)}\z/)
       end
       # 解析 VRP 认证域引用，避免将 VRP 语法应用到 Comware。
-      def vrp_tacacs_references(_kind, _domains) = []
+      def domain_tacacs_references(_kind, _domains) = []
       # 返回当前平台修改 SNMP 监听端口的命令模式。
       def snmp_port_command = "snmp-agent port"
 
       # 提取本地账号角色及凭据存储属性。
-      def accounts
+      def parse_local_accounts
         matching_blocks(/\Alocal-user\s+/).each do |section|
           next if section.text.start_with?("local-user password-")
           name = section.text.split[1]
@@ -210,7 +254,7 @@ module Baseline
             match = /\Apassword\s+(simple|cipher|hash|irreversible-cipher)\s+(.+)\z/.match(entry.text)
             record_credential(name, "local_user", match ? match[1] : "unknown", match ? match[2] : nil, entry)
           end
-          record_credential(name, "local_user", "unknown", nil, section) if passwords.empty? && @facts.complete?
+          record_credential(name, "local_user", "unknown", nil, section) if passwords.empty? && @fact_builder.complete?
         end
       end
     end

data/lib/baseline/evaluator.rb

@@ -38,22 +38,24 @@ module Baseline
         return finding(attributes, :unknown, configuration.status == :unsupported ? :unsupported_platform : :input_incomplete)
       end
       return finding(attributes, :unknown, :scope_unknown) if applicable.nil?
-      resolution = @policy.resolve_with_source(rule, context)
+      resolution = @policy.resolve_with_path(rule, context)
       attributes[:policy_path] = resolution.path
       return finding(attributes, :unknown, resolution.reason) if resolution.reason
       expected = attributes[:expected] = resolution.value
-      unless configuration.known?(rule.fact)
-        return finding(attributes, :unknown, configuration.complete? ? :fact_unavailable : :input_incomplete)
+      unless configuration.fact_known?(rule.fact)
+        unavailable = attributes[:diagnostics].any? { |issue| issue[:code] == :unsupported_capability && issue[:fact] == rule.fact }
+        reason = !configuration.complete? ? :input_incomplete : unavailable ? :unsupported_capability : :fact_unavailable
+        return finding(attributes, :unknown, reason)
       end
-      actual = configuration.value(rule.fact)
+      actual = configuration.fact(rule.fact)
       attributes[:actual] = actual
-      status, reason = compare(rule.operator, actual, expected)
+      status, reason, details = compare(rule.operator, actual, expected)
       # 不完整输入不能证明通过；仅保留补充记录也无法推翻的明确违规。
       if !configuration.complete? && (status == :pass || status == :fail && !conclusive_violation?(rule, actual, expected, configuration))
         status, reason = :unknown, :input_incomplete
       end
       if status == :fail
-        attributes[:details] = differences(rule.operator, actual, expected)
+        attributes[:details] = details || differences(rule.operator, actual, expected)
         # 尚未采集的配置可能补齐缺项，因此不将缺项作为已确认偏差展示。
         attributes[:details].delete(:missing) unless configuration.complete?
       end
@@ -88,7 +90,6 @@ module Baseline
       when :set_equals then { missing: expected - actual, unexpected: actual - expected }
       when :subset then { unexpected: actual - expected }
       when :count_at_least then { minimum: expected, actual_count: actual.size }
-      when :networks_within then { outside_approved: Acl.unapproved_networks(actual, expected) }
       when :all_disabled then { enabled: expected.select { |name| actual[name] == true } }
       else {}
       end
@@ -105,8 +106,8 @@ module Baseline
       rule.applies_to.each do |key, expected|
         values = key == "facts" ? expected : { key => expected }
         values.each do |name, criterion|
-          known = key == "facts" ? configuration.scope_known?(name) : context.key?(name)
-          value = key == "facts" ? configuration.value(name) : context[name]
+          known = key == "facts" ? configuration.applicability_fact_known?(name) : context.key?(name)
+          value = key == "facts" ? configuration.fact(name) : context[name]
           if !known
             unknown = true
           elsif !(criterion.is_a?(Array) ? criterion.include?(value) : criterion == value)
@@ -135,24 +136,38 @@ module Baseline
         when :subset then (actual - expected).empty?
         when :set_equals then actual.sort == expected.sort
         when :count_at_least then actual.size >= expected
-        when :networks_within then Acl.networks_within?(actual, expected)
+        when :networks_within
+          outside = Acl.unapproved_networks(actual, expected)
+          details = { outside_approved: outside }
+          outside.empty?
         end
       end
-      [ passed ? :pass : :fail, passed ? nil : :deviation ]
+      [ passed ? :pass : :fail, passed ? nil : :deviation, details ]
     rescue ArgumentError, IPAddr::InvalidAddressError
       [ :unknown, :unsupported_address_family ]
     end
 
     # 检查可度量的凭据属性，不保存秘密值。
     def password_strength(actual, expected)
-      return [ :unknown, :fact_type_mismatch ] unless actual.is_a?(Array) && actual.all? { |item| item.is_a?(Hash) }
-      visible = actual.select { |item| item[:storage] == "plaintext" }
+      return [ :unknown, :fact_type_mismatch ] unless actual.is_a?(Array)
+      valid = actual.select { |item| valid_strength_attributes?(item) }
+      visible = valid.select { |item| item[:storage] == "plaintext" }
       weak = visible.any? do |item|
         item[:common] || item.fetch(:length) < expected.fetch("min_length") || item.fetch(:character_classes) < expected.fetch("min_classes")
       end
       return [ :fail, :weak_password ] if weak
+      return [ :unknown, :fact_type_mismatch ] if valid.size != actual.size
       return [ :unknown, :password_strength_unobservable ] if actual.empty? || visible.size != actual.size
       [ :pass, nil ]
     end
+
+    # 公开事实入口可接受外部解析结果；损坏属性不能冒充可比较的口令证据。
+    def valid_strength_attributes?(item)
+      return false unless item.is_a?(Hash) && %w[plaintext legacy protected unknown].include?(item[:storage])
+      return true unless item[:storage] == "plaintext"
+
+      [ true, false ].include?(item[:common]) && item[:length].is_a?(Integer) && item[:length] >= 0 &&
+        item[:character_classes].is_a?(Integer) && item[:character_classes].between?(0, 4)
+    end
   end
 end

data/lib/baseline/{configuration.rb → evidence.rb}

@@ -4,7 +4,7 @@ require "ctx_parser/immutable"
 
 module Baseline
   # 在归一化配置中区分输入完整性、已知事实与局部不支持的语法。
-  class Configuration
+  class Evidence
     PARTIAL_SCOPE_FACTS = { "snmp.enabled" => true, "snmp.community_present" => true, "credentials.present" => true,
       "snmp.write_enabled" => true, "credentials.storage_safe" => false }.freeze
     attr_reader :platform, :sha256, :status, :facts, :sources, :issues
@@ -27,10 +27,10 @@ module Baseline
     # 判断配置采集与解析是否均已完成。
     def complete? = input_complete? && status == :complete
     # 读取已知值，同时保留事实缺失或未知的区别。
-    def value(path) = facts[path]
+    def fact(path) = facts[path]
 
     # 区分明确已知的事实与缺失、不支持的配置证据。
-    def known?(path)
+    def fact_known?(path)
       facts.key?(path) && issues.none? do |issue|
         scope = issue[:fact]
         scope && (path == scope || path.start_with?("#{scope}."))
@@ -38,12 +38,12 @@ module Baseline
     end
 
     # 局部输入可证明存在或明确违规，但不能证明缺失或所有成员均满足条件。
-    def scope_known?(path)
-      return false unless known?(path)
+    def applicability_fact_known?(path)
+      return false unless fact_known?(path)
       return true if complete?
       return false unless status == :partial
 
-      path == "hostname" || PARTIAL_SCOPE_FACTS.key?(path) && PARTIAL_SCOPE_FACTS[path] == value(path)
+      path == "hostname" || PARTIAL_SCOPE_FACTS.key?(path) && PARTIAL_SCOPE_FACTS[path] == fact(path)
     end
 
     # 返回公开的数据结构，并保留状态与诊断信息。