netstack 0.1.1 → 0.2.0

data/lib/netstack/integrations/http_delivery/client.rb

@@ -0,0 +1,127 @@
+# frozen_string_literal: true
+
+require "json"
+require "uri"
+
+module Netstack
+  module Integrations
+    module HttpDelivery
+      # Motor-compatible POST fields, plus an explicit key-based recovery endpoint.
+      class Client
+        def initialize(http:, lookup_path: "", lookup_parameter: "idempotency_key")
+          @http = http
+          @lookup_path = lookup_path == "" ? "" : Values.text(lookup_path, name: "lookup path", optional: true) || ""
+          @lookup_parameter = Values.text(lookup_parameter, name: "lookup parameter")
+        end
+
+        def inspect = "#<#{self.class.name}>"
+
+        def submit(target:, artifact:, credentials:, idempotency_key:, request_no: nil, target_id: nil)
+          key = validate_key!(idempotency_key)
+          request_no = Values.text(request_no, name: "request number") unless request_no.nil?
+          validate_identifier!(target_id, name: "target id") unless target_id.nil?
+          unless artifact.is_a?(Configuration::Artifact) && artifact.executable?
+            raise InputError, "delivery requires a single-target artifact"
+          end
+          artifact.validate_target!(target)
+          auth = validate_credentials!(credentials)
+          device = device_snapshot(target)
+          response = @http.request(:post, "", headers: { "Accept" => "application/json", "Idempotency-Key" => key }, json: {
+            request_no: request_no, target_id: target_id || target.key, idempotency_key: key,
+            device: device, credentials: auth, script: artifact.content
+          })
+          data = response.json
+          if data.is_a?(Hash) && data.key?("idempotency_key") && data["idempotency_key"] != key
+            raise Error.new("delivery submission returned a different operation", code: :delivery_identity_mismatch, stage: :submit)
+          end
+          normalize(data)
+        end
+
+        def status(remote_id: nil, idempotency_key:)
+          key = validate_key!(idempotency_key)
+          remote_id = validate_identifier!(remote_id, name: "remote id") unless remote_id.nil?
+          response = if remote_id
+            id = Values.text(remote_id.to_s, name: "remote id")
+            raise InputError, "delivery task identifier cannot be a path dot segment" if %w[. ..].include?(id)
+            @http.request(:get, URI.encode_uri_component(id), headers: { "Accept" => "application/json" })
+          else
+            @http.request(:get, @lookup_path, query: { @lookup_parameter => key }, headers: { "Accept" => "application/json" })
+          end
+          data = response.json
+          if data.is_a?(Hash) && ((!remote_id && data["idempotency_key"] != key) || (data.key?("idempotency_key") && data["idempotency_key"] != key))
+            raise Error.new("delivery lookup returned a different operation", code: :delivery_identity_mismatch, stage: :verify)
+          end
+          result = normalize(data, fallback_id: remote_id)
+          if remote_id && result.remote_id != remote_id.to_s
+            raise Error.new("delivery lookup returned a different remote task", code: :delivery_identity_mismatch, stage: :verify)
+          end
+          result
+        rescue Http::Error => error
+          # A missing index record cannot establish non-execution after an uncertain POST.
+          return Result.new(status: :not_found) if error.code.to_s == "http_status" && error.details["status"] == 404
+
+          raise
+        end
+
+        def validate_credentials!(credentials)
+          auth = Configuration::Support.object(credentials, name: "delivery credentials")
+          unless auth.keys.sort == %w[password username] && auth.values.all? { |value| value.is_a?(String) && !value.empty? }
+            raise InputError, "delivery credentials require username and password"
+          end
+          auth
+        end
+
+        private
+
+        def normalize(data, fallback_id: nil)
+          raise Error.new("invalid delivery response", code: :invalid_delivery_response, stage: :response) unless data.is_a?(Hash)
+
+          status = case data["status"]&.to_s&.downcase
+          when "success", "succeeded", "completed" then :succeeded
+          when "failed", "error", "rejected" then :failed
+          when "accepted", "pending", "queued", "running", "processing" then :running
+          when nil, ""
+            if data["success"] == true then :succeeded
+            elsif data["success"] == false then :failed
+            else :unknown
+            end
+          else :unknown
+          end
+          task_id = validate_identifier!(data["task_id"], name: "task id") unless data["task_id"].nil?
+          identifier = validate_identifier!(data["id"], name: "task id") unless data["id"].nil?
+          if task_id && identifier && task_id != identifier
+            raise Error.new("conflicting delivery task identifiers", code: :delivery_identity_mismatch, stage: :response)
+          end
+          remote_id = task_id || identifier || fallback_id
+          if %w[. ..].include?(remote_id)
+            raise Error.new("invalid delivery task identifier", code: :invalid_delivery_response, stage: :response)
+          end
+          output = data["output"] || data["result"]
+          output = JSON.generate(output) unless output.nil? || output.is_a?(String)
+          Result.new(status: status, remote_id: remote_id, output: output)
+        end
+
+        def validate_identifier!(value, name:)
+          unless value.is_a?(String) || value.is_a?(Integer)
+            raise InputError, "#{name} must be text or an integer"
+          end
+          Values.text(value.to_s, name: name)
+        end
+
+        def validate_key!(key)
+          unless key.is_a?(String) && key.match?(/\A[a-zA-Z0-9_.:-]{1,256}\z/)
+            raise InputError, "invalid delivery idempotency key"
+          end
+          key
+        end
+
+        def device_snapshot(target)
+          allowed = %w[id serial name hostname vendor model os device_role source]
+          supplied = Configuration::Support.object(target.attributes, name: "target attributes")
+          supplied.slice(*allowed).merge("id" => supplied.fetch("id", target.key), "name" => supplied.fetch("name", target.key),
+            "ip" => target.host, "vendor" => supplied.fetch("vendor", target.platform))
+        end
+      end
+    end
+  end
+end

data/lib/netstack/integrations/http_delivery/result.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Integrations
+    module HttpDelivery
+      class Result
+        STATUSES = %i[succeeded failed running unknown not_found].freeze
+        attr_reader :status, :remote_id
+
+        def initialize(status:, remote_id: nil, output: nil)
+          raise InputError, "invalid delivery result status" unless STATUSES.include?(status)
+          raise InputError, "delivery output must be text" unless output.nil? || output.is_a?(String)
+
+          @status = status
+          @remote_id = remote_id.nil? ? nil : Values.text(remote_id.to_s, name: "remote id")
+          @output = output&.dup&.freeze
+          freeze
+        end
+
+        def output = @output
+        def succeeded? = status == :succeeded
+        def failed? = status == :failed
+        def inspect = "#<#{self.class.name} status=#{status}>"
+      end
+    end
+  end
+end

data/lib/netstack/integrations/oxidized/client.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+require "uri"
+require "time"
+
+module Netstack
+  module Integrations
+    module Oxidized
+      # Oxidized Web's queue endpoint is a side-effectful GET. HTTP never retries it.
+      class Client
+        def initialize(base_url: nil, http: nil, **http_options)
+          @http = http || Http::Client.new(base_url: base_url, **http_options)
+        end
+
+        def inspect = "#<#{self.class.name}>"
+
+        def nodes
+          rows = @http.request(:get, "/nodes.json").json
+          invalid! unless rows.is_a?(Array) && rows.all? { |row| row.is_a?(Hash) && row["name"].is_a?(String) && !row["name"].empty? }
+          rows = rows.map do |row|
+            next row unless row["last"]
+            invalid! unless row["last"].is_a?(Hash)
+            last = row["last"].dup
+            %w[start end].each { |key| last[key] = timestamp(last[key]) if last[key] }
+            row.merge("last" => last)
+          end
+          Values.copy(rows)
+        end
+
+        def configuration(node_name:, group: nil)
+          @http.request(:get, node_path("/node/fetch", node_name, group), headers: { "Accept" => "text/plain" }).body
+        end
+
+        def request_backup(node_name:, group: nil) # rubocop:disable Naming/PredicateMethod -- command, not a predicate
+          result = @http.request(:get, "#{node_path("/node/next", node_name, group)}.json").json
+          invalid! unless result == ["ok"] || result == "ok"
+          true
+        end
+
+        def versions(node_name:, group: nil)
+          node_name = segment(node_name)
+          group = segment(group) unless group.nil?
+          rows = @http.request(:get, "/node/version.json", query: { node_full: [group, node_name].compact.join("/") }).json
+          invalid! unless rows.is_a?(Array) && rows.all? { |row| row.is_a?(Hash) && row["oid"].is_a?(String) && !row["oid"].empty? }
+          invalid! unless rows.map { |row| row["oid"] }.uniq.length == rows.length
+          Values.copy(rows)
+        end
+
+        def diff(node_name:, group: nil, from_oid:, to_oid:)
+          rows = @http.request(:get, "/node/version/diffs", query: {
+            format: "json", node: segment(node_name), group: group.nil? ? "" : segment(group),
+            oid: Values.text(from_oid, name: "from_oid"), oid2: Values.text(to_oid, name: "to_oid"), epoch: 0, num: 0
+          }).json
+          invalid! unless rows.is_a?(Array) && rows.all? { |row| row.is_a?(String) }
+          Values.copy(rows)
+        end
+
+        private
+
+        # Upstream JSON.generate serializes Time objects via Time#to_s (UTC).
+        def timestamp(value)
+          invalid! unless value.is_a?(String)
+          time = if value.match?(/\A\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}(?:\.\d+)? UTC\z/)
+            Time.iso8601(value.sub(" ", "T").sub(" UTC", "Z"))
+          else
+            Time.iso8601(value)
+          end
+          time.iso8601(6)
+        rescue ArgumentError
+          invalid!
+        end
+
+        def node_path(prefix, name, group)
+          [prefix, *[group, name].compact.map { |value| URI.encode_www_form_component(segment(value)).gsub("+", "%20") }].join("/")
+        end
+
+        def segment(value)
+          value = Values.text(value, name: "Oxidized node or group")
+          raise InputError, "Invalid Oxidized node or group" if value.match?(/[\x00-\x1f\x7f]/) || %w[. ..].include?(value)
+          value
+        end
+
+        def invalid!
+          raise Netstack::Error.new("Invalid Oxidized response", code: :invalid_response, stage: :response)
+        end
+      end
+    end
+  end
+end

data/lib/netstack/integrations/zabbix/client.rb

@@ -0,0 +1,211 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Integrations
+    module Zabbix
+      # JSON-RPC 传输与资源映射；监控资源归属策略由上层决定。
+      # 响应 ID 必须匹配请求；凭据和 RPC 错误正文保持私有。
+      class Client
+        RESOURCES = {
+          "host" => %w[hostid hostids], "hostgroup" => %w[groupid groupids],
+          "template" => %w[templateid templateids], "proxygroup" => %w[proxy_groupid proxy_groupids],
+          "hostinterface" => %w[interfaceid interfaceids], "usermacro" => %w[hostmacroid hostmacroids],
+          "item" => %w[itemid itemids], "trigger" => %w[triggerid triggerids]
+        }.freeze
+
+        def initialize(token:, api_url: nil, http: nil)
+          unless token.is_a?(String) && !token.strip.empty? && !token.match?(/[\r\n\x00]/)
+            raise Netstack::InputError.new("Zabbix token is required", code: "invalid_zabbix_configuration")
+          end
+
+          @token = token.dup.freeze
+          @http = http || Http::Client.new(base_url: api_url)
+          @sequence = 0
+          @mutex = Mutex.new
+        end
+
+        def inspect = "#<#{self.class.name}>"
+
+        def call(method, params = {}, authenticate: true)
+          unless method.is_a?(String) && method.match?(/\A[a-z]+\.[a-z]+\z/i) && (params.is_a?(Hash) || params.is_a?(Array))
+            raise Netstack::InputError.new("Invalid JSON-RPC request", code: "invalid_rpc_input")
+          end
+
+          id = @mutex.synchronize { @sequence += 1 }
+          headers = { "Accept" => "application/json", "Content-Type" => "application/json-rpc" }
+          headers["Authorization"] = "Bearer #{@token}" if authenticate
+          payload = @http.request(:post, "", headers: headers,
+                                             json: { jsonrpc: "2.0", method: method, params: params, id: id }).json
+          unless payload.is_a?(Hash) && payload["jsonrpc"] == "2.0" && payload["id"].is_a?(Integer) &&
+                 payload["id"] == id && (payload.key?("result") ^ payload.key?("error"))
+            invalid_response!(method)
+          end
+          if payload.key?("error")
+            error = payload["error"]
+            invalid_response!(method) unless error.is_a?(Hash) && error["code"].is_a?(Integer) && error["message"].is_a?(String)
+            raise Error.new("Zabbix rejected #{method}", code: "zabbix_rejected", stage: "response",
+                                                         details: { "method" => method, "provider_code" => error["code"] }), cause: nil
+          end
+          payload.fetch("result")
+        end
+
+        def api_version
+          version = call("apiinfo.version", {}, authenticate: false)
+          invalid_response!("apiinfo.version") unless version.is_a?(String) && version.match?(/\A\d+\.\d+(?:\.\d+)?\z/)
+          version
+        end
+
+        def query(resource, params = {})
+          singular, = resource_keys(resource)
+          method = "#{resource}.get"
+          rows = call(method, default_query(resource).merge(params))
+          rows = validate_rows!(rows, method: method, id_key: singular)
+          rows = rows.map { |row| normalize_host!(row, method) } if resource.to_s == "host"
+          rows.each { |row| validate_interface!(row, method) } if resource.to_s == "hostinterface"
+          if resource.to_s == "trigger"
+            rows.each do |row|
+              validate_rows!(row["dependencies"], method: method, id_key: "triggerid")
+              invalid_response!(method) unless valid_tags?(row["tags"])
+            end
+          end
+          rows
+        end
+
+        def get(resource, id)
+          _, plural = resource_keys(resource)
+          rows = query(resource, plural => [identifier!(id)])
+          invalid_response!("#{resource}.get") unless rows.size <= 1
+          row = rows.first
+          invalid_response!("#{resource}.get") if row && row.fetch(resource_keys(resource).first).to_s != id.to_s
+          row
+        end
+
+        def find(resource, params)
+          rows = query(resource, params)
+          invalid_response!("#{resource}.get") unless rows.size <= 1
+          rows.first
+        end
+
+        def create(resource, attributes)
+          mutate(resource, "create", attributes)
+        end
+
+        def update(resource, id, attributes)
+          singular, = resource_keys(resource)
+          identifier!(id)
+          mutate(resource, "update", attributes.merge(singular => id.to_s), expected_id: id.to_s)
+        end
+
+        def history(item_id:, value_type:, from:, to:, limit: 10_000)
+          range!(from, to, limit)
+          raise Netstack::InputError.new("Only numeric Zabbix history is supported", code: "unsupported_history_type") unless [0, 3].include?(value_type)
+
+          rows = call("history.get", { history: value_type, itemids: [identifier!(item_id)],
+                                       time_from: from, time_till: to, limit: limit, output: "extend", sortfield: %w[clock ns], sortorder: "ASC" })
+          validate_rows!(rows, method: "history.get", id_key: "itemid", unique: false)
+        end
+
+        def trends(item_id:, from:, to:, limit: 10_000)
+          range!(from, to, limit)
+          rows = call("trend.get", { itemids: [identifier!(item_id)], time_from: from, time_till: to,
+                                     limit: limit, output: %w[itemid clock num value_min value_avg value_max], sortfield: "clock", sortorder: "ASC" })
+          validate_rows!(rows, method: "trend.get", id_key: "itemid", unique: false)
+        end
+
+        def problems(host_id:, from:, limit: 100)
+          range!(from, from, limit)
+          rows = call("problem.get", { hostids: [identifier!(host_id)], time_from: from, recent: true,
+                                       limit: limit, output: %w[eventid objectid name severity acknowledged clock r_clock], sortfield: "eventid", sortorder: "DESC" })
+          validate_rows!(rows, method: "problem.get", id_key: "eventid")
+        end
+
+        def resource_keys(resource)
+          RESOURCES.fetch(resource.to_s) do
+            raise Netstack::InputError.new("Unsupported Zabbix resource", code: "unsupported_zabbix_resource")
+          end
+        end
+
+        private
+
+        def validate_interface!(row, method)
+          unless valid_identifier?(row["hostid"]) && %w[1 2 3 4].include?(row["type"].to_s) &&
+                 %w[0 1].include?(row["main"].to_s) && %w[0 1].include?(row["useip"].to_s) &&
+                 %w[ip dns port].all? { |key| row[key].is_a?(String) }
+            invalid_response!(method)
+          end
+          invalid_response!(method) if row["type"].to_s == "2" && !row["details"].is_a?(Hash)
+        end
+
+        def valid_tags?(tags)
+          tags.is_a?(Array) && tags.all? { |tag| tag.is_a?(Hash) && tag["tag"].is_a?(String) && tag["value"].is_a?(String) }
+        end
+
+        def normalize_host!(row, method)
+          groups = row["hostgroups"]
+          templates = row["parentTemplates"]
+          tags = row["tags"]
+          inventory = row["inventory"]
+          validate_rows!(groups, method: method, id_key: "groupid")
+          validate_rows!(templates, method: method, id_key: "templateid")
+          unless valid_tags?(tags) &&
+                 (inventory.is_a?(Hash) || inventory == [])
+            invalid_response!(method)
+          end
+          row.merge("groups" => groups, "inventory" => inventory == [] ? {} : inventory)
+        end
+
+        def default_query(resource)
+          case resource.to_s
+          when "host"
+            { "output" => "extend", "selectHostGroups" => %w[groupid], "selectParentTemplates" => %w[templateid],
+              "selectTags" => "extend", "selectInventory" => "extend" }
+          when "trigger"
+            { "output" => "extend", "selectTags" => "extend", "selectDependencies" => %w[triggerid], "expandExpression" => true }
+          when "usermacro"
+            # Secret macro values cannot be read back and are never needed for discovery.
+            { "output" => %w[hostmacroid hostid macro type] }
+          else
+            { "output" => "extend" }
+          end
+        end
+
+        def mutate(resource, action, attributes, expected_id: nil)
+          _, plural = resource_keys(resource)
+          method = "#{resource}.#{action}"
+          result = call(method, attributes)
+          ids = result[plural] if result.is_a?(Hash)
+          invalid_response!(method) unless ids.is_a?(Array) && ids.one? && valid_identifier?(ids.first) && (!expected_id || ids.first.to_s == expected_id)
+          ids.first.to_s
+        end
+
+        def validate_rows!(rows, method:, id_key:, unique: true)
+          invalid_response!(method) unless rows.is_a?(Array) && rows.all? { |row| row.is_a?(Hash) && valid_identifier?(row[id_key]) }
+          ids = rows.map { |row| row[id_key].to_s }
+          invalid_response!(method) if unique && ids.uniq.size != ids.size
+          rows
+        end
+
+        def valid_identifier?(value)
+          (value.is_a?(Integer) && value.positive?) || (value.is_a?(String) && value.match?(/\A[1-9][0-9]*\z/))
+        end
+
+        def identifier!(value)
+          return value.to_s if valid_identifier?(value)
+
+          raise Netstack::InputError.new("Invalid Zabbix identifier", code: "invalid_zabbix_id")
+        end
+
+        def range!(from, to, limit)
+          return if from.is_a?(Integer) && from >= 0 && to.is_a?(Integer) && to >= from && limit.is_a?(Integer) && (1..100_000).cover?(limit)
+
+          raise Netstack::InputError.new("Invalid measurement interval or limit", code: "invalid_measurement_range")
+        end
+
+        def invalid_response!(method)
+          raise Error.new("Invalid Zabbix response for #{method}", code: "invalid_zabbix_response", stage: "response",
+                                                                   details: { "method" => method }), cause: nil
+        end
+      end
+    end
+  end
+end

data/lib/netstack/integrations/zabbix/error.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Integrations
+    module Zabbix
+      class Error < Netstack::Error
+      end
+    end
+  end
+end

data/lib/netstack/inventory/address.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+
+module Netstack
+  module Inventory
+    class Address < Data.define(:host, :prefix, :family)
+      def initialize(host:, prefix: nil, family: nil)
+        text = Values.text(host, name: "interface address")
+        raise InputError, "scoped interface addresses need an explicit interface scope" if text.include?("%")
+
+        address, suffix = text.split("/", 2)
+        raise InputError, "prefix specified twice" if suffix && !prefix.nil?
+
+        ip = ::IPAddr.new(address)
+        limit = ip.ipv4? ? 32 : 128
+        prefix = Values.integer(prefix || suffix || limit, name: "prefix", min: 0, max: limit)
+        actual_family = ip.ipv4? ? :ipv4 : :ipv6
+        raise InputError, "address family mismatch" if family && family.to_sym != actual_family
+
+        super(host: ip.to_s.freeze, prefix: prefix, family: actual_family)
+      rescue ::IPAddr::Error
+        raise InputError, "invalid interface address"
+      end
+
+      def cidr = "#{host}/#{prefix}"
+      def network = "#{::IPAddr.new(cidr)}/#{prefix}"
+    end
+  end
+end

data/lib/netstack/inventory/changes.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Inventory
+    class Changes < Data.define(:target, :source, :dimensions, :skipped)
+      def initialize(target:, source:, dimensions:, skipped:)
+        super(target: target, source: source, dimensions: Values.copy(dimensions), skipped: Values.copy(skipped))
+      end
+
+      def empty? = dimensions.values.all? { |change| change.values.all?(&:empty?) }
+    end
+  end
+end

data/lib/netstack/inventory/cli_parser.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Inventory
+    class CliParser
+      PLATFORMS = %w[h3c h3c_wireless huawei cisco_ios cisco_nxos].freeze
+
+      def supports?(platform) = PLATFORMS.include?(platform.to_s)
+
+      def device(configuration:, version:, target:)
+        raise UnsupportedCapability, "inventory platform is not implemented" unless supports?(target.platform)
+
+        config = Configuration::Reader.new(configuration).content
+        version = Configuration::Reader.new(version).content
+        name = config[/^\s*(?:hostname|sysname)\s+(\S+)\s*$/, 1]
+        raise InputError, "configuration does not contain a recognizable device identity" unless name
+
+        serial = version[/(?:Processor board ID|Device serial number\s*:|Serial Number\s*:|System serial number\s*:)\s*(\S+)/i, 1]
+        os = version[/(?:NXOS: version|system:\s*version|Software, Version|VRP.*Version|IOS.*Version)\s*([^\r\n,]+)/i, 1]&.strip
+        model = version[/^\s*(?:cisco|H3C|HUAWEI)\s+([A-Za-z0-9][A-Za-z0-9_-]+)(?:\s+(?:processor|Chassis|Switch|Router)|\s*\()/i, 1]
+        Device.new(key: target.key, name: name, serial: serial, model: model, vendor: target.platform.split("_").first,
+          os_version: os, attributes: {})
+      end
+
+      def interfaces(configuration:, platform:)
+        raise UnsupportedCapability, "inventory platform is not implemented" unless supports?(platform)
+
+        reader = Configuration::Reader.new(configuration)
+        rows = []
+        current = nil
+        while (line = reader.read)
+          if (match = /^interface\s+(\S+)\s*$/.match(line))
+            rows << build_interface(current) if current
+            current = { name: match[1], addresses: [], admin_status: :unknown, attributes: {} }
+          elsif current && line.match?(/\A\S/) && !line.match?(/\A(?:#|!)\s*\z/)
+            rows << build_interface(current)
+            current = nil
+          elsif current
+            parse_interface_line(current, line.strip)
+          end
+        end
+        rows << build_interface(current) if current
+        unless reader.content.match?(/^\s*(?:hostname|sysname)\s+\S+/)
+          raise InputError, "interface configuration identity is missing"
+        end
+        raise InputError, "duplicate interface identity" unless rows.map(&:key).uniq.size == rows.size
+
+        rows.freeze
+      end
+
+      private
+
+      def parse_interface_line(current, text)
+        case text
+        when /\Adescription\s+(.+)\z/ then current[:description] = Regexp.last_match(1)
+        when /\A(?:shutdown|disable)\z/ then current[:admin_status] = :down
+        when /\A(?:no shutdown|undo shutdown)\z/ then current[:admin_status] = :up
+        when /\Aip address\s+(\S+\/\d+)(?:\s+.*)?\z/
+          current[:addresses] << Address.new(host: IPv4.host_cidr(Regexp.last_match(1)))
+        when /\Aip address\s+(\S+)\s+(\S+)(?:\s+.*)?\z/
+          current[:addresses] << Address.new(host: IPv4.host_cidr(Regexp.last_match(1), Regexp.last_match(2)))
+        when /\Aipv6 address\s+(\S+\/\d+)(?:\s+.*)?\z/
+          current[:addresses] << Address.new(host: IPv6.canonical(Regexp.last_match(1), host: true))
+        when /\Amtu\s+(\d+)\z/ then current[:attributes][:mtu] = Integer(Regexp.last_match(1), 10)
+        when /\A(?:ip|ipv6) address\b/
+          raise InputError, "unsupported interface address syntax"
+        end
+      end
+
+      def build_interface(attributes)
+        Interface.new(**attributes)
+      end
+    end
+  end
+end