netstack 0.1.1 → 0.2.0

data/lib/netstack/vxlan/cisco_nxos/config_parser.rb

@@ -0,0 +1,327 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+require "digest"
+
+module Netstack
+  module Vxlan
+    module CiscoNxos
+      # Parses NX-OS configuration contexts, keeping ACL order and routing policy.
+      # The caller supplies transport completeness; parsing cannot prove a file is whole.
+      class ConfigParser
+        def parse(text, target:, complete: false)
+          Validation.invalid!("configuration must be a String") unless text.is_a?(String)
+          Validation.invalid!("complete must be boolean") unless [true, false].include?(complete)
+          issues = []
+          sections = tree(text)
+          interfaces = parse_interfaces(sections, issues)
+          vlan_vnis = parse_vlans(sections, issues)
+          nve = parse_nve(sections, issues)
+          bgp = parse_bgp(sections)
+          role = target.attributes[:role] || target.attributes["role"]
+          role = if role
+                   role.to_sym
+                 else
+                   (if nve.empty?
+                      reflector?(bgp) ? :spine : :unknown
+                    else
+                      :leaf
+                    end)
+                 end
+          hostname = sections.filter_map { |entry| entry[:text][/\Ahostname\s+(\S+)\z/, 1] }.last
+          issues << { code: :hostname_missing } unless hostname
+          segments = build_segments(interfaces, vlan_vnis, issues)
+          management_ip = target.attributes[:management_ip] || target.attributes["management_ip"] || ip_address(target.host)
+          Node.new(key: target.key, hostname: hostname, management_ip: management_ip, role: role,
+                   features: sections.filter_map { |entry| entry[:text][/\Afeature\s+(.+)\z/, 1] },
+                   interfaces: interfaces, vlan_vnis: vlan_vnis, vrfs: parse_vrfs(sections), nve: nve,
+                   evpn: parse_evpn(sections), bgp: bgp, vpc_domain: parse_vpc(sections, interfaces),
+                   acls: parse_acls(sections), prefix_lists: parse_prefix_lists(sections),
+                   route_maps: parse_route_maps(sections), segments: segments,
+                   anycast_mac: sections.filter_map { |entry| entry[:text][/\Afabric forwarding anycast-gateway-mac (\S+)\z/, 1] }.last,
+                   complete: complete && issues.empty?, issues: issues, config_digest: config_digest(text))
+        end
+
+        private
+
+        def tree(text)
+          roots = []
+          stack = []
+          text.gsub("\r", "").each_line.with_index(1) do |line, number|
+            value = line.strip
+            next if value.empty? || value.start_with?("!", "#")
+
+            indentation = line[/\A\s*/].size
+            entry = { text: value, line: number, children: [] }
+            stack.pop while stack.any? && stack.last[0] >= indentation
+            (stack.empty? ? roots : stack.last[1][:children]) << entry
+            stack << [indentation, entry]
+          end
+          roots
+        end
+
+        def direct(entry) = entry[:children].map { |child| child[:text] }
+        def value(lines, pattern) = lines.filter_map { |line| line[pattern, 1] }.last
+
+        def config_digest(text)
+          commands = text.gsub("\r", "").lines.reject { |line| line.strip.empty? || line.lstrip.start_with?("!") }
+          Digest::SHA256.hexdigest(commands.map(&:rstrip).join("\n"))
+        end
+
+        def parse_interfaces(sections, issues)
+          sections.each_with_object({}) do |entry, result|
+            name = entry[:text][/\Ainterface (\S+)\z/, 1]
+            next unless name
+
+            name = name.sub(/\Avlan/i, "Vlan")
+            lines = direct(entry)
+            addresses = lines.filter_map { |line| line[/\Aip address (\S+)(?: secondary)?\z/, 1] }
+            issues << { code: :unsupported_interface_address, interface: name, line: entry[:line] } if lines.grep(/\Aip address /).size != addresses.size
+            valid_addresses = addresses.filter_map do |address|
+              unless %r{\A\d+(?:\.\d+){3}/\d+\z}.match?(address) && ip_prefix?(address)
+                issues << { code: :invalid_interface_address, interface: name, line: entry[:line] }
+                next
+              end
+              address
+            end
+            result[name] = {
+              addresses: valid_addresses, vrf: value(lines, /\Avrf member (\S+)\z/),
+              anycast: lines.include?("fabric forwarding mode anycast-gateway"),
+              shutdown: if lines.include?("shutdown")
+                          true
+                        else
+                          lines.include?("no shutdown") ? false : nil
+                        end,
+              acl_bindings: lines.each_with_object({}) do |line, acls|
+                acls[Regexp.last_match(2).to_sym] = Regexp.last_match(1) if /\Aip access-group (\S+) (in|out)\z/.match(line)
+              end,
+              vpc_id: value(lines, /\Avpc (\d+)\z/)&.to_i,
+              peer_link: lines.include?("vpc peer-link"),
+              channel_group: value(lines, /\Achannel-group (\d+)(?: mode \S+)?\z/)&.to_i,
+              ospf: value(lines, /\Aip router ospf (.+)\z/),
+              description: value(lines, /\Adescription (.+)\z/)
+            }
+          end
+        end
+
+        def parse_vlans(sections, issues)
+          sections.each_with_object({}) do |entry, result|
+            match = /\Avlan ([\d,-]+)\z/.match(entry[:text])
+            next unless match
+
+            ids = expand_ids(match[1], 1..4094)
+            vni = value(direct(entry), /\Avn-segment (\d+)\z/)&.to_i
+            issues << { code: :invalid_vlan_mapping, line: entry[:line] } if direct(entry).any? { |line| line.start_with?("vn-segment ") } && vni.nil?
+            if !ids || (vni && (ids.size != 1 || !vni.between?(1, 16_777_215)))
+              issues << { code: :invalid_vlan_mapping, line: entry[:line] }
+              next
+            end
+            ids.each { |id| result[id] = vni }
+          end
+        end
+
+        def expand_ids(text, range)
+          entries = text.split(",").flat_map do |part|
+            first, last = part.split("-").map(&:to_i)
+            return nil unless range.cover?(first) && (!last || (range.cover?(last) && last >= first))
+
+            last ? (first..last).to_a : [first]
+          end
+          entries.uniq
+        end
+
+        def parse_nve(sections, issues)
+          entries = sections.select { |entry| /\Ainterface nve\d+\z/i.match?(entry[:text]) }
+          issues << { code: :multiple_nve_interfaces } if entries.size > 1
+          return {} if entries.empty?
+
+          entry = entries.first
+          lines = direct(entry)
+          members = {}
+          entry[:children].each do |child|
+            match = /\Amember vni (\d+)(?: (associate-vrf))?\z/.match(child[:text])
+            unless match
+              issues << { code: :unsupported_nve_member, line: child[:line] } if child[:text].start_with?("member vni ")
+              next
+            end
+            settings = direct(child)
+            members[match[1].to_i] = {
+              associate_vrf: !match[2].nil?, replication: settings.include?("ingress-replication protocol bgp") ? :bgp : nil,
+              multicast_group: value(settings, /\Amcast-group (\S+)\z/)
+            }
+          end
+          { interface: entry[:text].split.last, source_interface: value(lines, /\Asource-interface (\S+)\z/),
+            host_reachability: value(lines, /\Ahost-reachability protocol (\S+)\z/),
+            shutdown: if lines.include?("shutdown")
+                        true
+                      else
+                        lines.include?("no shutdown") ? false : nil
+                      end, members: members }
+        end
+
+        def route_targets(lines)
+          lines.filter_map do |line|
+            match = /\Aroute-target (import|export|both) (\S+)(?: (evpn))?\z/.match(line)
+            { direction: match[1].to_sym, target: match[2], evpn: !match[3].nil? } if match
+          end
+        end
+
+        def parse_vrfs(sections)
+          sections.each_with_object({}) do |entry, vrfs|
+            name = entry[:text][/\Avrf context (\S+)\z/, 1]
+            next unless name
+
+            lines = direct(entry)
+            families = entry[:children].select { |child| child[:text].start_with?("address-family ") }
+            vrfs[name] = { vni: value(lines, /\Avni (\d+)\z/)&.to_i, rd: value(lines, /\Ard (\S+)\z/),
+                           route_targets: route_targets(lines + families.flat_map { |family| direct(family) }),
+                           routes: lines.filter_map do |line|
+                             match = /\Aip route (\S+) (\S+)(.*)\z/.match(line)
+                             { prefix: match[1], next_hop: match[2], options: match[3].strip } if match
+                           end }
+          end
+        end
+
+        def parse_evpn(sections)
+          sections.select { |entry| entry[:text] == "evpn" }.flat_map { |entry| entry[:children] }.each_with_object({}) do |entry, vnis|
+            match = /\Avni (\d+) (L[23])/i.match(entry[:text])
+            next unless match
+
+            lines = direct(entry)
+            vnis[match[1].to_i] = { type: match[2].downcase.to_sym, rd: value(lines, /\Ard (\S+)\z/), route_targets: route_targets(lines) }
+          end
+        end
+
+        def parse_bgp(sections)
+          entry = sections.find { |section| /\Arouter bgp (\d+)\z/.match?(section[:text]) }
+          return {} unless entry
+
+          lines = direct(entry)
+          result = { asn: entry[:text].split.last.to_i, router_id: value(lines, /\Arouter-id (\S+)\z/), neighbors: {}, templates: {}, vrfs: {} }
+          entry[:children].each do |child|
+            match = /\A(neighbor|template peer|vrf) (\S+)\z/.match(child[:text])
+            next unless match
+
+            settings = direct(child)
+            families = child[:children].select { |sub| sub[:text].start_with?("address-family ") }.to_h do |family|
+              members = direct(family)
+              [family[:text].delete_prefix("address-family "), {
+                route_reflector_client: if members.include?("route-reflector-client")
+                                          true
+                                        else
+                                          members.include?("no route-reflector-client") ? false : nil
+                                        end,
+                extended_community: if members.include?("send-community extended") || members.include?("send-community both")
+                                      true
+                                    else
+                                      members.include?("no send-community extended") ? false : nil
+                                    end,
+                advertise_evpn: members.include?("advertise l2vpn evpn"),
+                redistribute: members.filter_map do |line|
+                  m = /\Aredistribute (\S+)(?: route-map (\S+))?\z/.match(line)
+                  { protocol: m[1], route_map: m[2] } if m
+                end
+              }]
+            end
+            kind = { "neighbor" => :neighbors, "template peer" => :templates, "vrf" => :vrfs }.fetch(match[1])
+            result[kind][match[2]] = { remote_as: value(settings, /\Aremote-as (\S+)\z/), inherit_peer: value(settings, /\Ainherit peer (\S+)\z/),
+                                       update_source: value(settings, /\Aupdate-source (\S+)\z/), address_families: families }
+          end
+          result
+        end
+
+        def reflector?(bgp)
+          %i[neighbors templates].any? do |kind|
+            bgp.fetch(kind, {}).values.any? do |peer|
+              peer[:address_families].values.any? do |family|
+                family[:route_reflector_client]
+              end
+            end
+          end
+        end
+
+        def parse_vpc(sections, interfaces)
+          entry = sections.find { |section| /\Avpc domain \d+\z/.match?(section[:text]) }
+          return unless entry
+
+          lines = direct(entry)
+          keepalive = value(lines, /\Apeer-keepalive (.+)\z/)
+          keepalive = keepalive ? keepalive.scan(/(destination|source|vrf) (\S+)/).to_h.transform_keys(&:to_sym) : {}
+          VpcDomain.new(id: entry[:text].split.last.to_i, peer_keepalive: keepalive,
+                        peer_links: interfaces.select { |_name, settings| settings[:peer_link] }.keys,
+                        member_ports: interfaces.filter_map { |name, settings| [settings[:vpc_id], name] if settings[:vpc_id] }.to_h,
+                        peer_gateway: lines.include?("peer-gateway"))
+        end
+
+        def parse_acls(sections)
+          sections.each_with_object({}) do |entry, acls|
+            name = entry[:text][/\Aip access-list (\S+)\z/, 1]
+            next unless name
+
+            acls[name] = direct(entry).filter_map do |line|
+              next if /\A(?:\d+ )?remark\b/.match?(line) || line == "statistics per-entry"
+
+              match = /\A(\d+) (permit|deny) (.+)\z/.match(line)
+              match ? { sequence: match[1].to_i, action: match[2].to_sym, expression: match[3] } : { unsupported: true }
+            end
+          end
+        end
+
+        def parse_prefix_lists(sections)
+          sections.each_with_object({}) do |entry, lists|
+            match = /\Aip prefix-list (\S+) seq (\d+) (permit|deny) (\S+)(.*)\z/.match(entry[:text])
+            next unless match
+
+            (lists[match[1]] ||= []) << { sequence: match[2].to_i, action: match[3].to_sym, prefix: match[4],
+                                          ge: match[5][/\bge (\d+)\b/, 1]&.to_i, le: match[5][/\ble (\d+)\b/, 1]&.to_i }
+          end
+        end
+
+        def parse_route_maps(sections)
+          sections.each_with_object({}) do |entry, maps|
+            match = /\Aroute-map (\S+) (permit|deny) (\d+)\z/.match(entry[:text])
+            next unless match
+
+            lines = direct(entry)
+            (maps[match[1]] ||= []) << { action: match[2].to_sym, sequence: match[3].to_i,
+                                         prefix_lists: lines.filter_map { |line| line[/\Amatch ip address prefix-list (.+)\z/, 1] }.flat_map(&:split),
+                                         additional_matches: lines.grep(/\Amatch /).reject { |line| line.start_with?("match ip address prefix-list ") },
+                                         sets: lines.grep(/\Aset /) }
+          end
+        end
+
+        def build_segments(interfaces, vlan_vnis, issues)
+          interfaces.filter_map do |name, settings|
+            match = /\AVlan(\d+)\z/i.match(name)
+            next unless match && vlan_vnis[match[1].to_i] && settings[:addresses].any?
+
+            if settings[:addresses].size > 1 || !settings[:vrf]
+              issues << { code: :unsupported_svi, interface: name }
+              next
+            end
+            address = settings[:addresses].first
+            network = IPAddr.new(address)
+            Segment.new(vlan_id: match[1].to_i, vni: vlan_vnis.fetch(match[1].to_i), vrf: settings[:vrf],
+                        prefix: "#{network}/#{address.split("/").last}", gateway: address.split("/").first,
+                        anycast: settings[:anycast], acl_bindings: settings[:acl_bindings])
+          rescue InputError
+            issues << { code: :invalid_segment, interface: name }
+            nil
+          end
+        end
+
+        def ip_address(value)
+          IPAddr.new(value).to_s
+        rescue IPAddr::InvalidAddressError, IPAddr::AddressFamilyError
+          nil
+        end
+
+        def ip_prefix?(value)
+          IPAddr.new(value).ipv4?
+        rescue IPAddr::InvalidAddressError
+          false
+        end
+      end
+    end
+  end
+end

data/lib/netstack/vxlan/cisco_nxos/deployment_adapter.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Vxlan
+    module CiscoNxos
+      # No retry of configuration writes. Recovery verifies desired state by readback.
+      class DeploymentAdapter
+        def initialize(connector: Connector)
+          @connector = connector
+        end
+
+        def preflight(plan:, previous:, credentials:) # rubocop:disable Naming/PredicateMethod -- Deployment adapter protocol requires this name.
+          validate_target!(plan.target)
+          plan.steps.each { |step| validate_step!(step) }
+          node = read_node(plan.target, credentials)
+          unless node.complete? && node.hostname == plan.preconditions[:hostname]
+            raise Error.new("VXLAN target identity or configuration evidence changed", code: :target_changed, stage: :preflight)
+          end
+          if !previous && node.config_digest != plan.preconditions[:config_digest]
+            raise Error.new("VXLAN configuration changed since planning", code: :stale_plan, stage: :preflight)
+          end
+
+          true
+        end
+
+        def apply(step:, target:, credentials:, idempotency_key:)
+          validate_target!(target)
+          validate_step!(step)
+          result = @connector.open(:cisco_nxos, **credentials, host: target.host) { |session| session.execute_script(step.parameters.fetch(:commands)) }
+          { status: result.success? ? :applied : :unknown, evidence: { completed_commands: result.steps.size, operation_key: idempotency_key } }
+        end
+
+        def verify(step:, target:, credentials:, receipt:)
+          Validation.invalid!("verification receipt must be a Hash") unless receipt.is_a?(Hash)
+          validate_target!(target)
+          validate_step!(step)
+          Verifier.new.verify(node: read_node(target, credentials), expected: step.expected)
+        end
+
+        private
+
+        def read_node(target, credentials)
+          result = @connector.open(:cisco_nxos, **credentials, host: target.host) { |session| session.execute_script(["show running-config"]) }
+          raise Error.new("configuration readback failed", code: :readback_failed, stage: :verify) unless result.success? && result.steps.size == 1
+
+          ConfigParser.new.parse(result.steps.first.output, target: target, complete: true)
+        end
+
+        def validate_target!(target)
+          Validation.invalid!("Cisco NX-OS deployment requires cisco_nxos target") unless target.platform.to_s == "cisco_nxos"
+        end
+
+        def validate_step!(step)
+          Validation.invalid!("unsupported VXLAN deployment action") unless step.action == "vxlan_segment"
+          commands = step.parameters[:commands]
+          Validation.invalid!("VXLAN commands must be nonempty single lines") unless commands.is_a?(Array) && !commands.empty? && commands.all? do |command|
+            command.is_a?(String) && !command.empty? && !/[\r\n\x00]/.match?(command)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/netstack/vxlan/cisco_nxos/runtime_parser.rb

@@ -0,0 +1,182 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Vxlan
+    module CiscoNxos
+      class RuntimeParser
+        COMMANDS = {
+          nve_peers: "show nve peers", nve_vnis: "show nve vni",
+          bgp_neighbors: "show bgp l2vpn evpn summary", ospf_neighbors: "show ip ospf neighbors",
+          vpc: "show vpc brief", interfaces: "show interface brief",
+          port_channels: "show port-channel summary", mac_addresses: "show mac address-table"
+        }.freeze
+        BGP_FRAMING = [
+          /\ABGP summary information for VRF \S+, address family .+\z/i,
+          /\ABGP router identifier [\da-f:.]+, local AS number [\d.]+\z/i,
+          /\ABGP table version is \d+(?:, L2VPN EVPN config peers \d+, capable peers \d+)?\z/i,
+          /\A\d+ network entries and \d+ paths using \d+ bytes of memory\z/i,
+          /\ABGP attribute entries \[\d+\/\d+\], BGP AS path entries \[\d+\/\d+\]\z/i,
+          /\ABGP community entries \[\d+\/\d+\], BGP clusterlist entries \[\d+\/\d+\]\z/i
+        ].freeze
+        PORT_CHANNEL_FRAMING = [
+          /\AFlags:\s+D - Down\s+P - Up in port-channel \(members\)\z/i,
+          /\AI - Individual\s+H - Hot-standby \(LACP only\)\z/i,
+          /\As - Suspended\s+r - Module-removed\z/i,
+          /\AS - Switched\s+R - Routed\z/i,
+          /\AU - Up \(port-channel\)\z/i,
+          /\AM - Not in use\. Min-links not met\z/i
+        ].freeze
+
+        def parse(dimension, text, complete: false)
+          Validation.invalid!("dimension must be a Symbol or String") unless dimension.is_a?(Symbol) || dimension.is_a?(String)
+          dimension = dimension.to_sym
+          Validation.invalid!("unknown VXLAN runtime dimension") unless COMMANDS.key?(dimension)
+          Validation.invalid!("runtime output must be a String") unless text.is_a?(String)
+          Validation.invalid!("complete must be boolean") unless [true, false].include?(complete)
+          if /(?:invalid command|invalid input|not supported|feature.*not enabled)/i.match?(text)
+            return RuntimeResult.new(dimension: dimension, status: :unsupported, issues: [{ code: :command_unsupported }])
+          end
+
+          rows, recognized, rejected, explicit_empty = send("parse_#{dimension}", text.gsub("\r", ""))
+          issues = []
+          issues << { code: :output_incomplete } unless complete
+          issues << { code: :format_unrecognized } unless recognized
+          issues << { code: :unparsed_rows, count: rejected } if rejected.positive?
+          issues << { code: :missing_completeness_evidence } if rows.empty? && !explicit_empty
+          RuntimeResult.new(dimension: dimension, status: issues.empty? ? :complete : :partial, records: rows, issues: issues)
+        end
+
+        private
+
+        def table(text, header:, empty:, framing: [])
+          rows = []
+          rejected = 0
+          explicit_empty = false
+          recognized_header = false
+          text.each_line do |line|
+            line = line.strip
+            next if line.empty? || /\A[-=]+\z/.match?(line) || framing.any? { |pattern| pattern.match?(line) }
+            if header.match?(line)
+              recognized_header = true
+              next
+            end
+            if empty.match?(line)
+              explicit_empty = true
+              next
+            end
+
+            row = yield(line)
+            row ? rows << row : rejected += 1
+          end
+          rejected += 1 if explicit_empty && rows.any?
+          [rows, recognized_header || explicit_empty || rows.any?, rejected, explicit_empty]
+        end
+
+        def parse_nve_peers(text)
+          table(text, header: /\AInterface\s+Peer-IP\s+State\s+LearnType\s+Uptime\s+Router-Mac\z/i,
+            empty: /\A(?:No peers(?: found)?|0 peers)\.?\z/i) do |line|
+            match = /\A(nve\d+)\s+(\d+(?:\.\d+){3})\s+(Up|Down)\s+(\S+)\s+(\S+)\s+(\S+)\z/i.match(line)
+            { interface: match[1], peer_ip: match[2], state: match[3].downcase.to_sym, learn_type: match[4], uptime: match[5], router_mac: match[6] } if match
+          end
+        end
+
+        def parse_nve_vnis(text)
+          table(text, header: /\AInterface\s+VNI\s+Multicast-group\s+State\s+Mode\s+Type\s+\[BD\/VRF\]\z/i,
+            empty: /\A(?:No VNIs(?: found)?|0 VNIs)\.?\z/i) do |line|
+            match = /\A(nve\d+)\s+(\d+)\s+(\S+)\s+(Up|Down)\s+(\S+)\s+(L[23])\s+\[([^\]]+)\](?:\s+.*)?\z/i.match(line)
+            if match
+              { interface: match[1], vni: match[2].to_i, multicast_group: match[3], state: match[4].downcase.to_sym,
+                mode: match[5], type: match[6].downcase.to_sym, association: match[7] }
+            end
+          end
+        end
+
+        def parse_bgp_neighbors(text)
+          table(text, header: /\ANeighbor\s+V\s+AS\s+MsgRcvd\s+MsgSent\s+TblVer\s+InQ\s+OutQ\s+Up\/Down\s+State\/PfxRcd\z/i,
+            empty: /\A(?:No (?:BGP )?neighbors(?: found)?|0 neighbors)\.?\z/i, framing: BGP_FRAMING) do |line|
+            match = /\A(\d+(?:\.\d+){3})\s+\d+\s+(\d+)\s+\d+\s+\d+\s+\d+\s+(\d+)\s+(\d+)\s+(\S+)\s+(.+)\z/.match(line)
+            next unless match
+
+            state = match[6].strip
+            { peer_ip: match[1], remote_as: match[2].to_i, input_queue: match[3].to_i, output_queue: match[4].to_i,
+              uptime: match[5], state: /\A\d+\z/.match?(state) ? :established : state.downcase.tr(" ", "_").to_sym,
+              prefixes_received: /\A\d+\z/.match?(state) ? state.to_i : nil }
+          end
+        end
+
+        def parse_ospf_neighbors(text)
+          table(text, header: /\ANeighbor ID\s+Pri\s+State\s+Up Time\s+Address\s+Interface\z/i,
+            empty: /\A(?:No (?:OSPF )?neighbors(?: found)?|0 neighbors)\.?\z/i,
+            framing: [/\AOSPF Process ID \S+ VRF \S+\z/i]) do |line|
+            match = /\A(\d+(?:\.\d+){3})\s+(\d+)\s+(\S+)\s+(\S+)\s+(\d+(?:\.\d+){3})\s+(\S+)\z/.match(line)
+            { neighbor_id: match[1], priority: match[2].to_i, state: match[3].downcase, uptime: match[4], address: match[5], interface: match[6] } if match
+          end
+        end
+
+        def parse_vpc(text)
+          row = {}
+          rejected = 0
+          fields = { domain_id: /\AvPC domain id\s*:\s*(\d+)\z/i, peer_status: /\APeer status\s*:\s*(.+)\z/i,
+            keepalive_status: /\AvPC keep-alive status\s*:\s*(.+)\z/i,
+            consistency_status: /\AConfiguration consistency status\s*:\s*(.+)\z/i,
+            role: /\AvPC role\s*:\s*(.+)\z/i }
+          text.each_line do |line|
+            line = line.strip
+            next if line.empty? || /\A[-=]+\z/.match?(line)
+            matched = fields.find { |_, pattern| pattern.match?(line) }
+            unless matched
+              rejected += 1
+              next
+            end
+            key, pattern = matched
+            value = line[pattern, 1]
+            if row.key?(key)
+              rejected += 1
+            else
+              row[key] = key == :domain_id ? value.to_i : value
+            end
+          end
+          return [[], false, rejected] if row.empty?
+
+          [[row], true, rejected + (%i[domain_id peer_status keepalive_status consistency_status] - row.keys).size]
+        end
+
+        def parse_interfaces(text)
+          table(text, header: /\A(?:Port\s+VRF\s+Status\s+IP Address|(?:Port|Interface)\s+Name\s+Status\s+Vlan\s+Duplex\s+Speed\s+Type)\z/i,
+            empty: /\A(?:No interfaces(?: found)?|0 interfaces)\.?\z/i) do |line|
+            next unless /\A(?:Eth(?:ernet)?\d|Po\d|port-channel\d|Vlan\d|loopback\d|nve\d)/i.match?(line)
+            tokens = line.split
+            state_index = tokens.index { |token| %w[up down connected notconnect disabled routed].include?(token.downcase) }
+            next unless state_index
+
+            { interface: tokens.first, state: tokens[state_index].downcase.to_sym, detail: tokens[(state_index + 1)..].join(" ") }
+          end
+        end
+
+        def parse_port_channels(text)
+          table(text, header: /\AGroup\s+Port-Channel\s+Type\s+Protocol\s+Member Ports\z/i,
+            empty: /\A(?:No port-channels(?: found)?|0 port-channels)\.?\z/i, framing: PORT_CHANNEL_FRAMING) do |line|
+            match = /\A(\d+)\s+(Po\d+)\(([^)]+)\)\s+(\S+)\s+(\S+)\s*(.*)\z/.match(line)
+            if match
+              members = match[6].split.map { |token| /\A([^\s()]+)\(([^\s()]+)\)\z/.match(token) }
+              next if members.any?(&:nil?)
+              { group: match[1].to_i, interface: match[2], flags: match[3], type: match[4], protocol: match[5],
+                members: members.map { |member| { interface: member[1], flags: member[2] } } }
+            end
+          end
+        end
+
+        def parse_mac_addresses(text)
+          table(text, header: /\AVLAN\s+MAC Address\s+Type\s+age\s+Secure\s+NTFY\s+Ports\z/i,
+            empty: /\A(?:No (?:MAC addresses|entries)(?: found)?|0 (?:MAC addresses|entries))\.?\z/i) do |line|
+            match = /\A(?:[*+GOCR]\s+)?(\d+)\s+([\da-f]{4}(?:\.[\da-f]{4}){2})\s+(dynamic|static)\s+(.+)\z/i.match(line)
+            if match
+              { vlan_id: match[1].to_i, mac: match[2].delete(".").scan(/../).join(":"), type: match[3].downcase.to_sym,
+                destination: match[4].split.last }
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/netstack/vxlan/cisco_nxos/segment_renderer.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Vxlan
+    module CiscoNxos
+      # Renders only known missing objects; it never deletes or replaces existing policy.
+      class SegmentRenderer
+        def render(segment:, components:, nve_interface:, replication: :bgp, multicast_group: nil,
+                   prefix_list: nil, prefix_sequence: nil)
+          Validation.name(nve_interface, "NVE interface")
+          commands = []
+          commands.push("vlan #{segment.vlan_id}", "vn-segment #{segment.vni}", "exit") if components.include?(:vlan)
+          if components.any? { |part| part.to_s.start_with?("svi") }
+            commands << "interface Vlan#{segment.vlan_id}"
+            commands << "no shutdown" if components.include?(:svi_enable)
+            commands << "vrf member #{segment.vrf}" if components.include?(:svi_vrf)
+            commands << "ip address #{segment.interface_address}" if components.include?(:svi_address)
+            commands << "fabric forwarding mode anycast-gateway" if components.include?(:svi_anycast)
+            segment.acl_bindings.each do |direction, name|
+              commands << "ip access-group #{name} #{direction}" if components.include?(:"svi_acl_#{direction}")
+            end
+            commands << "exit"
+          end
+          if components.include?(:nve)
+            commands.push("interface #{nve_interface}", "member vni #{segment.vni}")
+            commands << (replication == :bgp ? "ingress-replication protocol bgp" : "mcast-group #{multicast_group}")
+            commands.push("exit", "exit")
+          end
+          if components.include?(:evpn)
+            commands.push("evpn", "vni #{segment.vni} l2", "rd auto", "route-target import auto", "route-target export auto", "exit", "exit")
+          end
+          if components.include?(:advertisement)
+            Validation.name(prefix_list, "prefix-list")
+            Validation.integer(prefix_sequence, "prefix-list sequence", 1..4_294_967_294)
+            commands << "ip prefix-list #{prefix_list} seq #{prefix_sequence} permit #{segment.prefix}"
+          end
+          commands.empty? ? [].freeze : ["configure terminal", *commands, "end"].freeze
+        end
+      end
+    end
+  end
+end