net-connector 0.4.0

data/lib/net/connector/vendor/huawei.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require_relative "../device/base"
+require_relative "huawei/tftp_backup"
+
+module Net
+  module Connector
+    module Huawei
+      # Huawei 命令行连接器；提权延迟到命令批次开始时执行。
+      class Connector < Net::Connector::Base
+        vendor :huawei
+        # 声明 Huawei 的命令、提示、诊断、提权和保存确认规则。
+        profile do
+          running_config_strategy Net::Connector::RunningConfig::Rendered
+          tftp_strategy Net::Connector::Huawei::TftpBackup
+          commands do
+            running_config "dis cur"
+            save_config "save force"
+          end
+
+          prompts do
+            login(/(?:\A|(?<=[\r\n]))\s*\S+[>\]]\s*\z/)
+            command(/(?:\A|(?<=[\r\n]))[^\r\n]+[>\]]\s*\z/)
+            username(/(?:login|Username):\s*\z/i)
+          end
+
+          errors do
+            command(
+              /^\s*\^/,
+              /^[ \t]*error:/i,
+              /^[ \t]*Permission\s+denied\./i,
+              /
+                ^[ \t]*%[ \t]+(?:(?:Unrecognized|Ambiguous|Incomplete)\s+command|Too\s+many\s+parameters)
+                \s+found\s+at\s+'\^'\s+position\.
+              /ix
+            )
+          end
+
+          privilege do
+            command "su"
+            prompt(/privilege\s+(?:level\s+is|is\s+).+>\s*\z/im)
+          end
+
+          command_timeout 10
+
+          interactions do
+            confirm %r{Are\s+you\s+sure\?\s*\[Y/N\]}i, response: "y\n"
+            confirm(/press\s+the\s+enter\s+key\)/i, response: "\n")
+            confirm %r{Continue\?\s*\[Y/N\]}i, response: "y\n"
+            confirm(/Please\s+input\s+the\s+file\s+name\(\*\.cfg\)\[[^\]]+\]\s*\z/i, response: "\n")
+            confirm %r{overwrite\?\s*\[Y/N\]}i, response: "y\n"
+          end
+        end
+
+        protected
+
+        # 登录后若提示符以 ] 结尾，则确认设备已经处于特权视图。
+        def after_login(session, response)
+          session.mark_privileged! if response.prompt.include?("]")
+        end
+      end
+    end
+  end
+end

data/lib/net/connector/vendor/palo_alto/running_config.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+require "shellwords"
+require_relative "../../device/running_config/strategy"
+
+module Net
+  module Connector
+    module PaloAlto
+      class RunningConfig < Net::Connector::RunningConfig::Strategy
+        def result_step(result)
+          result.steps.find { |step| step.command.text == "show" }
+        end
+
+        # 采集切换视图时只改变结束符，仍绑定已认证的设备身份。
+        def prompt_text(command)
+          prompt = super
+          case command.text
+          when "configure" then prompt.sub(/[>#]\z/, "#")
+          when "exit" then prompt.sub(/[>#]\z/, ">")
+          else prompt
+          end
+        end
+
+        def check_response(command, response, _execution)
+          return unless command.text == "show config diff"
+          return if body(response.output, command.text).empty?
+
+          raise DeviceError.new("PAN-OS candidate differs from running configuration",
+                                code: :uncommitted_configuration, host: @device.host, phase: :collect)
+        end
+
+        def clean(text)
+          normalized = body(text, "show").sub(/(?:\A|\n)[ \t]*\[edit\][ \t]*\z/, "").strip
+          unless set_commands?(normalized)
+            raise DeviceError.new("PAN-OS configuration must be set format",
+                                  code: :unsupported_configuration_format, host: @device.host, phase: :collect)
+          end
+          normalized
+        end
+
+        private
+
+        # 证书等引号内换行必须闭合，不能将截断文本当成配置。
+        def set_commands?(text)
+          return false if text.empty?
+
+          pending = +""
+          text.each_line do |line|
+            next if pending.empty? && line.strip.empty?
+            return false if pending.empty? && !line.start_with?("set ")
+
+            pending << line
+            begin
+              Shellwords.split(pending)
+              pending.clear
+            rescue ArgumentError
+              # 未闭合引号继续读取；末尾仍未闭合则拒绝整个采集结果。
+            end
+          end
+          pending.empty?
+        end
+
+        def body(text, command)
+          text.gsub("\r\n", "\n").sub(/\A[ \t]*#{Regexp.escape(command)}[ \t]*\n/, "")
+              .sub(@device.profile.command_prompt, "").strip
+        end
+      end
+    end
+  end
+end

data/lib/net/connector/vendor/palo_alto/tftp_backup.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require_relative "../../operations/tftp/strategy"
+
+module Net
+  module Connector
+    module PaloAlto
+      class TftpBackup < Operations::Tftp::Strategy
+        # 返回 PAN-OS 固定使用的运行配置文件名。
+        def default_path(_source_file) = "running-config.xml"
+
+        # 构造当前厂商的 TFTP 导出交互脚本。
+        def script(target, source_file:, vrf: nil)
+          raise ArgumentError, "PAN-OS does not use source_file" if source_file
+          raise ArgumentError, "PAN-OS TFTP backup does not use vrf" if vrf
+          unless target.path == "running-config.xml"
+            raise ArgumentError, "PAN-OS TFTP export uses the fixed filename running-config.xml"
+          end
+
+          Script.new([Command.new("tftp export configuration to #{target.host} from running-config.xml",
+                                  timeout: 180)])
+        end
+
+        # 检查设备回显是否确认 TFTP 传输完成。
+        def complete?(result)
+          completion_lines(result).any? do |line|
+            line.match?(/\ASent\s+[1-9]\d*\s+bytes(?:\s+in\s+[\d.]+\s+(?:secs?|seconds?))?[.!]?\z/i)
+          end
+        end
+
+        # 返回 PAN-OS 实际上传的固定文件名。
+        def remote_path(_target, _result) = "running-config.xml"
+      end
+    end
+  end
+end

data/lib/net/connector/vendor/palo_alto/topology.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+require_relative "../../operations/topology/strategy"
+
+module Net
+  module Connector
+    module PaloAlto
+      class Topology < Operations::Topology::Strategy
+        def self.supports?(capability)
+          %i[neighbors interface_descriptions interface_description_changes].include?(capability)
+        end
+
+        def neighbor_command = "show lldp neighbors all"
+        def description_template = "palo_alto_interface_descriptions.textfsm"
+        def enter_configuration = "configure"
+        def finish_commands = ["commit", "exit"]
+
+        def expected_neighbor_count(output, _template)
+          neighbor_blocks(output).count { |block| !empty_neighbor_block?(block) }
+        end
+
+        def empty_neighbor_output?(output)
+          return true if output.match?(/No LLDP neighbors/i)
+
+          blocks = neighbor_blocks(output)
+          !blocks.empty? && blocks.all? { |block| empty_neighbor_block?(block) }
+        end
+
+        private
+
+        # PAN-OS 会列出启用 LLDP、但没有邻居的本机接口；只有明确为空的
+        # Neighbor information 块可跳过，缺字段的非空块继续交给数量校验拒绝。
+        def neighbor_blocks(output)
+          output.split(/^\s*Local information:\s*$/i).select { |block| block.match?(/^\s*Local interface:\s*\S+/i) }
+        end
+
+        def empty_neighbor_block?(block)
+          tail = block.split(/^\s*Neighbor information:\s*$/i, 2)
+          tail.size == 2 && tail.last.lines.all? { |line| line.strip.empty? || line.match?(/^\S+[>#]\s*$/) }
+        end
+
+        public
+
+        # 模板按行读取；未闭合的引号表示证据不完整，不能把首行当成旧描述。
+        def decode_description(value)
+          value = value.strip
+          value.start_with?('"') ? Shellwords.split(value).join(" ") : value
+        rescue ArgumentError
+          raise ParsingError.new("PAN-OS interface comment is not a complete single-line value",
+                                 code: :unrecognized_output, host: @device.host, phase: :parse)
+        end
+
+        def change_commands(change)
+          [%Q(set network interface ethernet #{change.interface} comment "#{change.new_description}")]
+        end
+
+        def script_command(command)
+          command == "commit" ? Command.new(command, timeout: 300) : command
+        end
+      end
+    end
+  end
+end

data/lib/net/connector/vendor/palo_alto.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require_relative "../device/base"
+require_relative "palo_alto/running_config"
+require_relative "palo_alto/tftp_backup"
+require_relative "palo_alto/topology"
+
+module Net
+  module Connector
+    module PaloAlto
+      # Palo Alto Networks PAN-OS 运维命令行和运行配置采集连接器。
+      class Connector < Net::Connector::Base
+        vendor :palo_alto
+        # 声明 PAN-OS 的命令、提示、超时、诊断和登录确认规则。
+        profile do
+          running_config_strategy Net::Connector::PaloAlto::RunningConfig
+          tftp_strategy Net::Connector::PaloAlto::TftpBackup
+          topology_strategy Net::Connector::PaloAlto::Topology
+          commands do
+            running_config "set cli pager off", "set cli config-output-format set", "show config diff",
+                           "configure", "show", "exit", "show config diff"
+          end
+
+          prompts do
+            login(/(?:\A|(?<=[\r\n]))(?:[^\s@]+)@[^\s>#]+[>#]\s*\z/)
+            command(/(?:\A|(?<=[\r\n]))(?:[^\s@]+)@[^\s>#]+[>#]\s*\z/)
+          end
+
+          errors do
+            command(/^[ \t]*(?:Invalid syntax|Unknown command|Server error|Command failed)(?:[.:]|\s)/i)
+          end
+
+          command_timeout 120
+
+          interactions do
+            login %r{(?:acknowledge|accept)[\s\S]*(?:yes/no|\[y/n\]|enter\s+yes)[^\r\n]*\z}i,
+                  response: "yes\n"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/net/connector/vendor/radware/tftp_backup.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require_relative "../../operations/tftp/strategy"
+
+module Net
+  module Connector
+    module Radware
+      class TftpBackup < Operations::Tftp::Strategy
+        # 生成 Radware 压缩配置的远端文件名。
+        def default_path(_source_file) = TftpTarget.filename(@device.host, extension: "tgz")
+
+        # 构造当前厂商的 TFTP 导出交互脚本。
+        def script(target, source_file:, vrf: nil)
+          raise ArgumentError, "Radware Alteon does not use source_file" if source_file
+          raise ArgumentError, "Radware TFTP backup does not use vrf" if vrf
+
+          Script.new([Command.new("/cfg/ptcfg #{target.host} -tftp", timeout: 180, interactions: [
+            interaction(/Enter\s+(?:hostname|IP address)[^\r\n]*:\s*\z/i, "#{target.host}\n"),
+            interaction(/Enter\s+name\s+of\s+(?:\.tgz\s+)?file[^\r\n]*:\s*\z/i, "#{target.path}\n"),
+            interaction(/Enter\s+username[^\r\n]*:\s*\z/i, "\n"),
+            interaction(/Include\s+private\s+keys\?\s*\[y\/n\]:\s*\z/i, "n\n"),
+            interaction(/Enter\s+"?mansync"?\s+to\s+get\s+real\/group\/virt\s+internal\s+index\s+config:\s*\z/i,
+                        "mansync\n")
+          ])])
+        end
+
+        # 检查设备回显是否确认 TFTP 传输完成。
+        def complete?(result)
+          completion_lines(result).any? do |line|
+            line.match?(/\A
+              (?:Current\s+)?(?:configuration|config)\s+
+              (?:successfully\s+(?:uploaded|tftp'd)|(?:uploaded|tftp'd)(?:\s+successfully)?|
+                complete(?:d)?(?:\s+successfully)?)[.!]?
+              \z/ix)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/net/connector/vendor/radware/topology.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+require_relative "../../operations/topology/strategy"
+
+module Net
+  module Connector
+    module Radware
+      class Topology < Operations::Topology::Strategy
+        def self.supports?(capability) = capability == :interface_descriptions
+        def description_template = "radware_port_names.textfsm"
+      end
+    end
+  end
+end

data/lib/net/connector/vendor/radware.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require_relative "../device/base"
+require_relative "radware/tftp_backup"
+require_relative "radware/topology"
+
+module Net
+  module Connector
+    module Radware
+      # Radware Alteon 和 DefensePro 命令行配置采集连接器。
+      class Connector < Net::Connector::Base
+        vendor :radware
+        # 声明菜单式 CLI 的命令、提示、超时、诊断和确认规则。
+        profile do
+          running_config_strategy Net::Connector::RunningConfig::Rendered
+          tftp_strategy Net::Connector::Radware::TftpBackup
+          topology_strategy Net::Connector::Radware::Topology
+          commands do
+            running_config "/cfg/dump"
+            save_config "/cfg/save"
+          end
+
+          prompts do
+            login(/(?:\A|(?<=[\r\n]))(?:>>[^\r\n]*|[^\r\n]+[>#])\s*\z/)
+            command(/(?:\A|(?<=[\r\n]))(?:>>[^\r\n]*|[^\r\n]+#)\s*\z/)
+          end
+
+          errors do
+            command(/^[ \t]*(?:Unknown|Invalid|Error)\s+command\b/i)
+          end
+
+          command_timeout 30
+
+          interactions do
+            confirm %r{Confirm\s+Sync\s+to\s+Peer\s+\[y/n\]:\s*\z}i, response: "y\n"
+            confirm %r{Synchronize\s+configuration\s+changes\?\s+\[y/n\]:\s*\z}i, response: "y\n"
+            confirm %r{Confirm\s+saving\s+to\s+FLASH\s+\[y/n\]:\s*\z}i, response: "y\n"
+            confirm %r{Confirm\s+operation\s+without\s+applying\s+changes\s+
+              \(leave\s+them\s+pending\)\s+\[y/n\]:\s*\z}ix, response: "y\n"
+            confirm %r{Confirm\s+operation\s+without\s+saving\s+changes\s+
+              \(leave\s+them\s+pending\)\s+\[y/n\]:?\s*\z}ix, response: "y\n"
+            confirm(/Confirm\s+seeing\s+above\s+note\s+\[y\]:\s*\z/i, response: "y\n")
+            confirm(/Please\s+enter\s+y\s+to\s+perform\s+the\s+action,\s+n\s+to\s+skip\s+it:\s*\z/i,
+                    response: "y\n"
+            )
+            confirm %r{Display\s+private\s+keys\?\s+\[y/n\]:\s*\z}i, response: "n\n"
+          end
+        end
+
+        # 连接有效期间返回登录横幅中的 HA 状态。
+        def ha_state = connected? ? @ha_state : nil
+
+        protected
+
+        # 从登录横幅提取 HA 状态并冻结，供连接期间查询。
+        def after_login(_session, response)
+          @ha_state = response.raw[/^\s*HA\s+State:\s*(\S+)/i, 1]&.freeze
+        end
+      end
+    end
+  end
+end

data/lib/net/connector/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Net
+  module Connector
+    VERSION = "0.4.0"
+  end
+end

data/lib/net/connector.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require_relative "connector/version"
+require_relative "connector/device/base"
+
+module Net
+  module Connector
+    VENDORS = {
+      h3c: "H3c",
+      h3c_wireless: "H3cWireless",
+      cisco_ios: "CiscoIos",
+      cisco_nxos: "CiscoNxos",
+      radware: "Radware",
+      palo_alto: "PaloAlto",
+      huawei: "Huawei",
+      hillstone: "Hillstone"
+    }.freeze
+
+    ALIASES = {
+      "cisco_n9k" => :cisco_nxos,
+      "paloalto" => :palo_alto
+    }.freeze
+
+    # 返回当前支持的厂商标识集合。
+    def self.vendors = VENDORS.keys
+
+    # 根据厂商标识查找连接器类。
+    def self.vendor_class(vendor)
+      key = vendor.to_s.downcase.tr(" -", "__")
+      key = ALIASES.fetch(key, key.to_sym)
+      name = VENDORS.fetch(key) { raise ArgumentError, "unsupported vendor: #{vendor.inspect}" }
+      require_relative "connector/vendor/#{key}"
+      const_get(name, false).const_get(:Connector, false)
+    end
+
+    # 根据厂商标识和连接参数创建设备对象。
+    def self.build(vendor, **settings)
+      vendor_class(vendor).new(**settings)
+    end
+
+    # 在代码块内连接设备并确保会话关闭。
+    def self.open(vendor, **settings)
+      raise ArgumentError, "open requires a block" unless block_given?
+
+      vendor_class(vendor).open(**settings) { |device| yield device }
+    end
+  end
+end

data/lib/net-connector.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require_relative "net/connector"