baseline-rb 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a69b4397f4b697acf294fb60e48af3ab3971ab7f17802d1bbaff4b87c6bc265
-  data.tar.gz: 965cffbfdf50b85f3c5ad210d7c21f58dedae938c156bc6e673ea468a15085f7
+  metadata.gz: 0ab48a464a299fae539f474ad2fdfce3079f8b6b49f930b72e92d3e686b0fd11
+  data.tar.gz: 500bf4fde6b208357f3fd8aa1fcbb8df4f24ed046568b9ed8ed888a2ee566586
 SHA512:
-  metadata.gz: 3c1492e3a89e7ae5fe118439a46002f3fa2750973f95c11368844bf044efd91bebfc24fd6c81e67441f4a12abbeaf6e0e22721e366090499e36e0ed75bea4042
-  data.tar.gz: f362962731008df44b80e3116fb8a0e55019d2aa775f2a2560f0255345775848dbabe737bf8c46d50903fc7afa9ac09e5a008a5f722eb5e700ea02c40caf9ba4
+  metadata.gz: 503da5d853fd3d86c8503f2df927fd9da752b8a4416552855e3063f0e5ee902610682de09eb023f5c7a645754aac552e1e6c6b947a646ea22f43cd567de6daec
+  data.tar.gz: dbfdd6e5590c2d2eb29c375858edaba14ff599452059f5ad0011b592e95c09c35c95826a021b5787e129e8d3f2d91f32bd8e7d775ec46cddbab57f549f28c2c4

data/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 Changes to the public contract are recorded here. Versions follow Semantic Versioning.
 
+## 0.3.1 (2026-10-18)
+
+- Withhold IOS SNMP ACL facts after contradictory community access declarations, while accepting equivalent repeats and preserving NX-OS incremental attributes.
+
+- Clear Bundler bootstrap variables when verifying packages in an isolated gem installation, including calls made through bundle exec.
+
+- Remove cancelled IOS SNMP communities and their credential evidence before deriving access and permission facts.
+
+- Keep management restrictions unknown when vendor ACL rules repeat an explicit sequence identity.
+- Stop reusing Cisco TACACS login methods after the final named list is cancelled or malformed; independent lists remain available.
+
 ## 0.3.0 (2026-10-18)
 
 - Breaking: rename mutable fact assembly to `FactBuilder`, immutable parsed snapshots to `Evidence`, multiline quoted-value documents to `MultilineDocument`, and the PAN-OS prefix lookup to `CommandIndex#matching_prefix`.

data/lib/baseline/cisco/parser.rb

@@ -147,8 +147,8 @@ module Baseline
         enabled = nxos? ? configured_state(/\Asnmp-server protocol enable\z/, /\Ano snmp-server protocol enable\z/) : nil
         enabled = nxos? || snmp_entries.any? if enabled.nil? && (@fact_builder.complete? || snmp_entries.any?)
         record_fact("snmp.enabled", enabled)
-        communities = {}
-        matching_blocks(/\Asnmp-server community\b/).each do |entry|
+        communities, community_acls = {}, {}
+        configured_community_entries.each do |entry|
           match = /\Asnmp-server community\s+(\S+)(?:\s+(.*))?\z/.match(entry.text)
           unless match
             record_unknown_snmp_access([ entry ])
@@ -162,6 +162,14 @@ module Baseline
           community[:write] = SNMP_ROLE_WRITE[role] if role
           acl = nxos? ? settings[/\buse-ipv4acl\s+(\S+)/, 1] : settings[/\A(?:ro|rw)\s+(\S+)\z/i, 1]
           community[:acl] = acl if acl
+          unless nxos?
+            access = (community_acls[match[1]] ||= { value: acl, conflicted: false })
+            access[:conflicted] ||= access[:value] != acl
+            if access[:conflicted]
+              community.delete(:acl)
+              record_unknown_fact("snmp.acl", [ entry ], code: :conflicting_community_acl)
+            end
+          end
           record_credential("snmp-community", "snmp", "plain", match[1], entry) unless @fact_builder.credential_recorded?(community[:line])
         end
         versions = communities.any? ? %w[v1 v2c] : []
@@ -226,6 +234,24 @@ module Baseline
         record_fact("snmp.versions", versions) unless versions.empty?
       end
 
+      # IOS 的 no 声明撤销整项团体字；先归约有效来源，避免留下访问或凭据事实。
+      def configured_community_entries
+        return matching_blocks(/\Asnmp-server community\b/) if nxos?
+
+        active = {}
+        matching_blocks(/\A(?:no )?snmp-server community\b/).each do |entry|
+          if (match = /\Ano snmp-server community\s+(\S+)\z/.match(entry.text))
+            analyze(entry) { active.delete(match[1]) }
+          elsif entry.text.start_with?("no ")
+            record_unknown_snmp_access([ entry ])
+          else
+            name = entry.text.split[2]
+            (active[name] ||= []) << entry
+          end
+        end
+        active.values.flatten.sort_by(&:line)
+      end
+
       # NX-OS 通常会同步 CLI 与 SNMP 账号；缺少证据时不能构造虚拟用户。
       def record_unverified_snmp_user_sync(users, enabled:)
         return if enabled == false
@@ -318,8 +344,12 @@ module Baseline
       # 解析各 VTY 实际选用的登录列表，包括命名列表。
       def record_tacacs_login_usage(servers, groups)
         pattern = /\Aaaa authentication login\s+(\S+)\s+(.+)\z/
-        lists = matching_blocks(pattern).each_with_object({}) do |entry, result|
-          name, methods = analyze(entry) { entry.text.match(pattern).captures }
+        family = /\A(?:no )?aaa authentication login\s+(\S+)(?:\s|\z)/
+        lists = matching_blocks(family).each_with_object({}) do |entry, result|
+          name = entry.text[family, 1]
+          match = pattern.match(entry.text)
+          # 最后同名声明决定列表证据；撤销或损坏不能复用先前的方法。
+          methods = match ? analyze(entry) { match[2] } : nil
           result[name] = { methods: methods, entry: entry }
         end
         entries = @fact_builder.vtys.filter_map { |vty| lists[vty[:authentication_list]]&.fetch(:entry) }.uniq
@@ -329,7 +359,7 @@ module Baseline
           elsif vty[:authentication] != "aaa"
             false
           elsif (list = lists[vty[:authentication_list]])
-            tacacs_login_method_state(list[:methods], servers, groups)
+            list[:methods] ? tacacs_login_method_state(list[:methods], servers, groups) : :authentication_list_unresolved
           else
             :authentication_list_unresolved
           end

data/lib/baseline/parser.rb

@@ -244,6 +244,12 @@ module Baseline
     # 注册有序 ACL 规则与别名，同时保留不支持的语法。
     def register_acl(name, entries, aliases: [], supported: true, source: nil, &block)
       commands = entries.reject { |entry| /\A(?:\d+\s+)?(?:description|remark|step|statistics|hardware-count)\b/.match?(entry.text) }
+      # 厂商显式序号是规则身份；重复身份不能靠来源先后消解。无序号规则保留原有顺序语义。
+      sequences = commands.filter_map do |entry|
+        match = /\A(?:access-list\s+\S+\s+)?(?:rule\s+)?(\d+)\s+(?:permit|deny)\b/.match(entry.text)
+        Integer(match[1], 10) if match
+      end
+      duplicate_sequences = sequences.uniq.size != sequences.size
       parsed = commands.map.with_index do |entry, index|
         value = analyze(entry) { block.call(entry, index) }
         cursor.mark(entry.index, state: :unsupported) unless value
@@ -256,8 +262,9 @@ module Baseline
         source ? source.line_range.cover?(line) : damaged_numbered_acl?(cursor.lines.fetch(line - 1).text, name)
       end
       acl = Acl.new(name: name, line: entries.first&.line, rules: parsed.compact,
-        supported: supported && !damaged && parsed.none?(&:nil?))
-      if @fact_builder.register_acl(acl, aliases: aliases, lines: entries.map(&:line)).any?
+        supported: supported && !damaged && !duplicate_sequences && parsed.none?(&:nil?))
+      conflicts = @fact_builder.register_acl(acl, aliases: aliases, lines: entries.map(&:line))
+      if duplicate_sequences || conflicts.any?
         entries.each { |entry| cursor.mark(entry.index, state: :unsupported) }
       end
     end

data/lib/baseline/version.rb

@@ -2,5 +2,5 @@
 
 module Baseline
   # 公开包版本，供 RubyGems 元数据和运行时调用方共用。
-  VERSION = "0.3.0"
+  VERSION = "0.3.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: baseline-rb
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Gatework contributors