baseline-rb 0.2.1 → 0.3.1

data/lib/baseline/{facts.rb → fact_builder.rb}

@@ -7,7 +7,7 @@ require "ctx_parser/result"
 
 module Baseline
   # 归并跨命令引用及未知状态，不依赖厂商语法或解析游标。
-  class Facts
+  class FactBuilder
     attr_reader :vtys
 
     # 初始化带来源信息的事实存储，并显式记录证据完整性。
@@ -18,6 +18,7 @@ module Baseline
       @vtys, @communities, @snmp_users, @credentials = [], [], [], []
       @credential_lines = {}
       @snmp_groups = {}
+      @snmp_group_issues = []
       @snmp_permission_issues = []
       @ssh_acl = nil
       @management_ports = { "ssh" => 22, "stelnet" => 22, "telnet" => 23 }
@@ -29,39 +30,43 @@ module Baseline
     def complete? = @complete
 
     # 相关配置语句格式错误时，不能继续依据配置缺失推导结论。
-    def incomplete!(code:, lines: [])
+    def mark_incomplete!(code:, lines: [])
       @complete = false
       @issues << { code: code, lines: lines.uniq }
     end
 
     # 防火墙可直接声明来源网段，不要求一定引用路由器式命名 ACL。
-    def direct_acl(fact:, sources:, bound:, lines: [])
+    def record_source_restriction(fact:, sources:, bound:, lines: [])
       unless %w[management.acl snmp.acl].include?(fact) && [ true, false ].include?(bound) &&
           (sources.nil? || sources.is_a?(Array))
         raise ArgumentError, "Direct access requires a known scope, binding state and source networks"
       end
-      networks = sources && Acl.network_prefixes(sources.map { |source| Acl.address_range(source) })
+      networks = sources && Acl.cidrs_from_ranges(sources.map { |source| Acl.ipv4_range(source) })
       @direct_acls[fact] = true
-      record("#{fact}.bound", bound, lines: lines)
+      record_fact("#{fact}.bound", bound, lines: lines)
       if networks
-        record("#{fact}.sources", networks, lines: lines)
-        record("#{fact}.restricted", !networks.include?("0.0.0.0/0"), lines: lines)
+        record_fact("#{fact}.sources", networks, lines: lines)
+        record_fact("#{fact}.restricted", !networks.include?("0.0.0.0/0"), lines: lines)
       else
-        %w[sources restricted].each { |key| unknown("#{fact}.#{key}", lines: lines, code: :acl_unresolved) }
+        %w[sources restricted].each { |key| record_unknown_fact("#{fact}.#{key}", lines: lines, code: :acl_unresolved) }
       end
     end
 
     # 将 false 保留为已知事实；输入不完整时，不接受 nil 或空集作为确定值。
-    def record(path, value, lines: [])
+    def record_fact(path, value, lines: [])
       return false if value.nil? || (!complete? && value.respond_to?(:empty?) && value.empty?)
 
       @values[path] = CtxParser::Immutable.copy(value)
-      @sources[path] = lines.uniq unless lines.empty?
+      if lines.empty?
+        @sources.delete(path)
+      else
+        @sources[path] = lines.uniq
+      end
       true
     end
 
     # 记录事实不可用的原因，并保留对应的来源行。
-    def unknown(path, lines: [], code: :unsupported_syntax)
+    def record_unknown_fact(path, lines: [], code: :unsupported_syntax)
       @issues << { code: code, fact: path, lines: lines.uniq }
     end
 
@@ -69,22 +74,23 @@ module Baseline
     def register_acl(acl, aliases: [], lines: [])
       keys = ([ acl.name ] + aliases).uniq
       duplicates = keys.select { |key| @acls.key?(key) }
-      duplicates.each { |key| unknown("acls.#{key}", lines: lines, code: :duplicate_acl) }
+      duplicates.each { |key| record_unknown_fact("acls.#{key}", lines: lines, code: :duplicate_acl) }
       keys.each { |key| @acls[key] = acl }
       duplicates
     end
 
     # 根据监听服务、认证方式与 ACL 绑定关系归纳管理访问事实。
-    def management(vtys:, ssh_acl: nil, ssh_port: 22, telnet_port: 23)
+    def record_management_access(vtys:, ssh_acl: nil, ssh_port: 22, telnet_port: 23)
       @vtys, @ssh_acl = CtxParser::Immutable.copy(vtys), CtxParser::Immutable.copy(ssh_acl)
       @management_ports = { "ssh" => ssh_port, "stelnet" => ssh_port, "telnet" => telnet_port }
     end
 
     # 根据用户、组和团体字归纳 SNMP 暴露面及凭据事实。
-    def snmp(communities:, users:, groups: nil, port: 161)
+    def record_snmp_access(communities:, users:, groups: nil, port: 161)
       @snmp_port = port
       @communities = CtxParser::Immutable.copy(communities)
       @snmp_groups = CtxParser::Immutable.copy(groups || {})
+      @snmp_group_issues = []
       @snmp_users = users.map do |user|
         if groups && user[:group]
           if groups.key?(user[:group])
@@ -92,10 +98,10 @@ module Baseline
             user = user.merge(write: group[:write])
             unless user[:acl]
               user = user.merge(acl: group[:acl])
-              unknown("snmp.acl", code: :snmp_group_ambiguous) if group[:acl_ambiguous]
+              @snmp_group_issues << { code: :snmp_group_ambiguous, fact: "snmp.acl", lines: [] } if group[:acl_ambiguous]
             end
           elsif !user[:acl]
-            unknown("snmp.acl", code: :snmp_group_unresolved)
+            @snmp_group_issues << { code: :snmp_group_unresolved, fact: "snmp.acl", lines: [] }
           end
         end
         CtxParser::Immutable.copy(user)
@@ -103,7 +109,7 @@ module Baseline
     end
 
     # 即使其他权限尚未解析，已确认的写权限仍属于违规证据。
-    def self.write_permission(permissions)
+    def self.write_permission_state(permissions)
       return true if permissions.include?(true)
       return false if permissions.all?(false)
 
@@ -111,7 +117,7 @@ module Baseline
     end
 
     # 暂存不完整的访问证据，优先保留已确认的权限授予事实。
-    def unknown_snmp_permission(lines: [], code: :snmp_permission_unresolved)
+    def record_unknown_snmp_permission(lines: [], code: :snmp_permission_unresolved)
       @snmp_permission_issues << { code: code, fact: "snmp.write_enabled", lines: lines.uniq }
     end
 
@@ -128,32 +134,47 @@ module Baseline
     end
 
     # 汇总事实与诊断，并保留证据完整性状态。
-    def result
-      record("acls", @acls.values.uniq.map(&:to_h))
-      management_facts
-      snmp_facts
-      credential_facts
+    def build
+      dup.build_snapshot
+    end
+
+    # 展示对象身份与状态，避免泄露原始回显或凭据。
+    def inspect = "#<#{self.class} complete=#{complete?} facts=#{@values.size}>"
+
+    protected
+
+    # 归约仅写入当前副本，后续快照始终从解析器提供的原始证据重新生成。
+    def build_snapshot
+      record_fact("acls", @acls.values.uniq.map(&:to_h))
+      record_management_facts
+      record_snmp_facts
+      record_credential_facts
       @issues << { code: :hostname_missing } unless @values.key?("hostname")
       @issues << { code: :input_not_confirmed_complete } unless @confirmed_complete
       status = complete? && @values.key?("hostname") ? :complete : :partial
       CtxParser::Result.new(status: status,
-        records: CtxParser::Immutable.copy([ { "facts" => @values, "sources" => @sources } ]), issues: CtxParser::Immutable.copy(@issues.uniq))
+        records: [ { "facts" => @values, "sources" => @sources } ], issues: @issues.uniq)
     end
 
-    # 展示对象身份与状态，避免泄露原始回显或凭据。
-    def inspect = "#<#{self.class} complete=#{complete?} facts=#{@values.size}>"
-
     private
 
+    # 已记录的值不可变；复制归约会更新的容器即可隔离派生事实与诊断。
+    def initialize_copy(original)
+      super
+      @values = @values.dup
+      @sources = @sources.dup
+      @issues = @issues.dup
+    end
+
     # 归纳管理服务监听端点及其实际生效的访问限制。
-    def management_facts
-      record("ssh.vty", vtys)
+    def record_management_facts
+      record_fact("ssh.vty", vtys)
       if vtys.any? && vtys.all? { |entry| entry[:protocols] }
         protocols = vtys.flat_map { |entry| entry[:protocols] }.uniq
-        record("ssh.vty_ssh_only", protocols.any? && (protocols - %w[ssh stelnet]).empty?)
+        record_fact("ssh.vty_ssh_only", protocols.any? && (protocols - %w[ssh stelnet]).empty?)
       end
       if vtys.any? && vtys.all? { |entry| entry[:authentication] }
-        record("ssh.vty_aaa", vtys.all? { |entry| %w[scheme aaa local].include?(entry[:authentication]) })
+        record_fact("ssh.vty_aaa", vtys.all? { |entry| %w[scheme aaa local].include?(entry[:authentication]) })
       end
       # 全局 SSH ACL 仅覆盖明确限制为 SSH 的管理监听端点。
       bindings = if @ssh_acl && @values["ssh.vty_ssh_only"] == true
@@ -161,40 +182,44 @@ module Baseline
       else
         vtys.map { |entry| { name: entry[:acl], ports: management_ports(entry[:protocols]) } }
       end
-      acl_sources(bindings, protocol: "tcp", fact: "management.acl") unless @direct_acls["management.acl"]
+      record_acl_sources(bindings, protocol: "tcp", fact: "management.acl") unless @direct_acls["management.acl"]
       if vtys.any?
         %w[ssh.vty_ssh_only ssh.vty_aaa management.acl.bound].each { |path| @sources[path] = vtys.map { |entry| entry[:line] } }
       end
     end
 
     # 归纳 SNMP 监听、团体字及用户的安全属性。
-    def snmp_facts
-      record("snmp.communities", @communities)
-      record("snmp.community_present", @communities.any?) if complete? || @communities.any?
+    def record_snmp_facts
+      @issues.concat(@snmp_group_issues)
+      record_fact("snmp.communities", @communities)
+      record_fact("snmp.community_present", @communities.any?) if complete? || @communities.any?
       access = @communities + @snmp_users + @snmp_groups.values
       permissions = access.map { |entry| entry[:write] }
       permissions << nil unless @snmp_permission_issues.empty?
-      writable = self.class.write_permission(permissions)
-      record("snmp.write_enabled", writable, lines: access.flat_map { |entry| entry[:lines] || [ entry[:line] ] }.compact)
+      writable = self.class.write_permission_state(permissions)
+      record_fact("snmp.write_enabled", writable, lines: access.flat_map { |entry| entry[:lines] || [ entry[:line] ] }.compact)
       if writable.nil?
-        unknown("snmp.write_enabled", code: :snmp_permission_unresolved)
+        record_unknown_fact("snmp.write_enabled", code: :snmp_permission_unresolved)
         @issues.concat(@snmp_permission_issues)
       end
-      record("snmp.users", @snmp_users)
-      record("snmp.v3_auth_priv", @snmp_users.all? { |entry| entry[:auth] && entry[:priv] }) if @snmp_users.any?
+      record_fact("snmp.users", @snmp_users)
+      if @snmp_users.any?
+        record_fact("snmp.v3_auth_priv", @snmp_users.all? { |entry| entry[:auth] && entry[:priv] },
+          lines: @snmp_users.map { |entry| entry[:line] }.compact)
+      end
       bindings = (@communities + @snmp_users).map { |entry| { name: entry[:acl], ports: @snmp_port ? [ @snmp_port ] : nil } }
-      acl_sources(bindings, protocol: "udp", fact: "snmp.acl") unless @direct_acls["snmp.acl"]
+      record_acl_sources(bindings, protocol: "udp", fact: "snmp.acl") unless @direct_acls["snmp.acl"]
     end
 
     # 汇总凭据存储方式及可度量的强度属性。
-    def credential_facts
-      record("credentials.records", @credentials)
-      record("credentials.present", @credentials.any?) if complete? || @credentials.any?
+    def record_credential_facts
+      record_fact("credentials.records", @credentials)
+      record_fact("credentials.present", @credentials.any?) if complete? || @credentials.any?
       return if @credentials.empty?
 
       storage = @credentials.map { |entry| entry[:storage] }
       safe = storage.any? { |value| %w[plaintext legacy].include?(value) } ? false : storage.include?("unknown") ? nil : true
-      record("credentials.storage_safe", safe)
+      record_fact("credentials.storage_safe", safe)
       %w[credentials.records credentials.storage_safe].each { |path| @sources[path] = @credentials.map { |entry| entry[:line] }.uniq }
     end
 
@@ -206,13 +231,13 @@ module Baseline
     end
 
     # 解析已绑定 ACL 的来源范围，并保留不支持的证据。
-    def acl_sources(bindings, protocol:, fact:)
+    def record_acl_sources(bindings, protocol:, fact:)
       names = bindings.map { |binding| binding[:name] }
       if names.empty? || names.any? { |name| name.nil? || name.empty? }
-        record("#{fact}.bound", false) if complete?
+        record_fact("#{fact}.bound", false) if complete?
         return
       end
-      record("#{fact}.bound", true)
+      record_fact("#{fact}.bound", true)
       resolved = bindings.uniq.map do |binding|
         name = binding[:name]
         acl = @acls[name]
@@ -222,13 +247,13 @@ module Baseline
         sources.flatten unless sources.any?(&:nil?)
       end
       if resolved.any?(&:nil?)
-        unknown("#{fact}.sources", code: :acl_unresolved)
-        unknown("#{fact}.restricted", code: :acl_unresolved)
+        record_unknown_fact("#{fact}.sources", code: :acl_unresolved)
+        record_unknown_fact("#{fact}.restricted", code: :acl_unresolved)
         return
       end
-      sources = Acl.network_prefixes(resolved.flatten.uniq.map { |cidr| Acl.address_range(cidr) })
-      record("#{fact}.sources", sources)
-      record("#{fact}.restricted", !sources.include?("0.0.0.0/0"))
+      sources = Acl.cidrs_from_ranges(resolved.flatten.uniq.map { |cidr| Acl.ipv4_range(cidr) })
+      record_fact("#{fact}.sources", sources)
+      record_fact("#{fact}.restricted", !sources.include?("0.0.0.0/0"))
       lines = names.uniq.flat_map { |name| @acls.fetch(name).rules.map { |rule| rule[:line] } }.compact.uniq
       %w[sources restricted].each { |field| @sources["#{fact}.#{field}"] = lines }
     end

data/lib/baseline/h3c/parser.rb

@@ -9,15 +9,17 @@ module Baseline
       private
 
       # 匹配当前平台显式启用 SSH 的命令。
-      def ssh_enable = /\Assh server enable\z/
+      def ssh_enable_pattern = /\Assh server enable\z/
       # 匹配当前平台显式禁用 SSH 的命令。
-      def ssh_disable = /\A(?:undo ssh server enable|ssh server disable)\z/
+      def ssh_disable_pattern = /\A(?:undo ssh server enable|ssh server disable)\z/
       # 匹配当前平台 TACACS 配置块的根语句。
-      def tacacs_section = /\Ahwtacacs scheme\s+/
+      def tacacs_section_pattern = /\Ahwtacacs scheme\s+/
       # 匹配认证、授权或计费服务器声明。
-      def tacacs_server = /\A(?:primary|secondary) (?:authentication|authorization|accounting)\s+(\S+)/
+      def tacacs_server_pattern = /\A(?:primary|secondary) (?:authentication|authorization|accounting)\s+(\S+)/
+      # 完整选择服务器命令族，缺失地址也必须保留为损坏证据。
+      def tacacs_server_family_pattern = /\A(?:undo )?(?:primary|secondary) (?:authentication|authorization|accounting)(?:\s|\z)/
       # 匹配已配置 TACACS 密钥的存储格式。
-      def tacacs_key = /\Akey (authentication|authorization|accounting) (simple|cipher) (.+)\z/
+      def tacacs_key_pattern = /\Akey (authentication|authorization|accounting) (simple|cipher) (.+)\z/
       # 要求具备当前平台 TACACS 方案使用的全部密钥角色。
       def tacacs_keys_complete?(types) = (%w[authentication authorization accounting] - types).empty?
     end

data/lib/baseline/hillstone/document.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
-require_relative "../quoted_document"
+require_relative "../multiline_document"
 
 module Baseline
   module Hillstone
     # StoneOS 导出内容可能包含命令回显、显式退出及引号包裹的界面状态。
-    class Document < QuotedDocument
+    class Document < MultilineDocument
       protected
 
       # 区分配置结构行与引号、横幅中的文本内容。