netstack 0.1.1 → 0.2.0

data/lib/netstack/wireless/access_point.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Wireless
+    class AccessPoint < Data.define(:key, :name, :ap_id, :group_name, :model, :serial_id, :mac_address, :ip_address, :state, :client_count, :online_seconds, :configuration)
+      def initialize(key:, name:, ap_id: nil, group_name: nil, model: nil, serial_id: nil, mac_address: nil, ip_address: nil, state: nil, client_count: nil, online_seconds: nil, configuration: {})
+        key = Values.text(key, name: "wireless record key")
+        super(**Values.copy(key: key, name: name, ap_id: ap_id, group_name: group_name, model: model, serial_id: serial_id, mac_address: mac_address, ip_address: ip_address, state: state, client_count: client_count, online_seconds: online_seconds, configuration: configuration))
+      end
+    end
+  end
+end

data/lib/netstack/wireless/ap_group.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Wireless
+    class ApGroup < Data.define(:key, :name, :ap_names, :serial_ids, :vlan_ids, :model_profiles, :configuration)
+      def initialize(key:, name:, ap_names: [], serial_ids: [], vlan_ids: [], model_profiles: {}, configuration: {})
+        key = Values.text(key, name: "wireless record key")
+        super(**Values.copy(key: key, name: name, ap_names: ap_names, serial_ids: serial_ids, vlan_ids: vlan_ids, model_profiles: model_profiles, configuration: configuration))
+      end
+    end
+  end
+end

data/lib/netstack/wireless/assessment.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Wireless
+    class Assessment < Data.define(:target, :findings, :dimension_statuses, :counts)
+      def initialize(target:, findings:, dimension_statuses:, counts:)
+        super(**Values.copy(target: target, findings: findings, dimension_statuses: dimension_statuses, counts: counts))
+      end
+
+      def healthy? = findings.empty? && dimension_statuses.values.any?(:complete) && dimension_statuses.values.all? { |status| %i[complete not_requested].include?(status) }
+    end
+  end
+end

data/lib/netstack/wireless/assessor.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Wireless
+    class Assessor
+      def initialize(relative_rssi_warning: 20, dbm_rssi_warning: -70, channel_usage_warning: 80, noise_floor_warning: -75,
+        ap_recent_seconds: 3600, client_recent_seconds: 1800)
+        @relative_rssi_warning = Float(relative_rssi_warning)
+        @dbm_rssi_warning = Float(dbm_rssi_warning)
+        @channel_usage_warning = Float(channel_usage_warning)
+        @noise_floor_warning = Float(noise_floor_warning)
+        @ap_recent_seconds = Values.integer(ap_recent_seconds, name: "AP recent uptime threshold", min: 0)
+        @client_recent_seconds = Values.integer(client_recent_seconds, name: "client recent uptime threshold", min: 0)
+        unless [@relative_rssi_warning, @dbm_rssi_warning, @channel_usage_warning, @noise_floor_warning].all?(&:finite?) &&
+          @dbm_rssi_warning.negative? && @noise_floor_warning.negative? && (0..100).cover?(@channel_usage_warning)
+          raise InputError, "invalid wireless assessment threshold"
+        end
+      rescue ArgumentError, TypeError
+        raise InputError, "invalid wireless assessment threshold"
+      end
+
+      def call(snapshot, expected_ap_names: [])
+        raise InvalidSnapshot, "wireless assessment requires a Snapshot" unless snapshot.is_a?(Snapshot)
+
+        findings = []
+        snapshot.dimensions.each do |dimension|
+          next if %i[complete not_requested].include?(dimension.status)
+          findings << finding(:incomplete_collection, :unknown, dimension.name, nil, status: dimension.status)
+        end
+        snapshot.records(:access_points).each do |ap|
+          if ap.state && !/\A(?:run|running|online|normal|up)\z/i.match?(ap.state)
+            findings << finding(:ap_not_online, :critical, :access_points, ap.key, state: ap.state)
+          elsif ap.state.nil?
+            findings << finding(:ap_state_unknown, :unknown, :access_points, ap.key)
+          end
+          if ap.online_seconds && ap.online_seconds < @ap_recent_seconds
+            findings << finding(:ap_recently_online, :warning, :access_points, ap.key, online_seconds: ap.online_seconds)
+          end
+        end
+        expected_ap_names.each { |name| Values.text(name, name: "expected AP name") }
+        missing = expected_ap_names - snapshot.records(:access_points).map(&:name)
+        missing.each do |name|
+          findings << finding(snapshot.dimension(:access_points).complete? ? :expected_ap_missing : :expected_ap_unconfirmed,
+            snapshot.dimension(:access_points).complete? ? :critical : :unknown, :access_points, Normalizer.key(name))
+        end
+        snapshot.records(:radios).each do |radio|
+          findings << finding(:radio_disabled, :warning, :radios, radio.key) if radio.admin_state && /\A(?:down|disabled)\z/i.match?(radio.admin_state)
+          if radio.channel_usage && radio.channel_usage > @channel_usage_warning
+            findings << finding(:radio_channel_busy, :warning, :radios, radio.key, channel_usage: radio.channel_usage)
+          end
+          if radio.noise_floor&.negative? && radio.noise_floor >= @noise_floor_warning
+            findings << finding(:radio_noise_high, :warning, :radios, radio.key, noise_floor: radio.noise_floor)
+          end
+        end
+        snapshot.records(:clients).each do |client|
+          threshold = client.rssi_scale == :dbm ? @dbm_rssi_warning : @relative_rssi_warning
+          if client.rssi && client.rssi != 0 && client.rssi < threshold
+            findings << finding(:client_weak_signal, :warning, :clients, client.key, rssi: client.rssi, scale: client.rssi_scale)
+          end
+          if client.online_seconds && client.online_seconds < @client_recent_seconds
+            findings << finding(:client_recently_online, :warning, :clients, client.key, online_seconds: client.online_seconds)
+          end
+          roam = client.attributes[:roam_status]
+          if roam && /fail|abnormal|error|frequent|sticky/i.match?(roam)
+            findings << finding(:client_roam_abnormal, :warning, :clients, client.key, roam_status: roam)
+          end
+        end
+        snapshot.view.diagnostics.each do |diagnostic|
+          findings << finding(diagnostic[:code], :unknown, :configuration, diagnostic[:record_key])
+        end
+        Assessment.new(target: snapshot.target, findings: findings, dimension_statuses: snapshot.dimensions.to_h { |dimension| [dimension.name, dimension.status] },
+          counts: snapshot.dimensions.to_h { |dimension| [dimension.name, dimension.records.size] })
+      end
+
+      private
+
+      def finding(code, severity, dimension, record_key, **details)
+        Finding.new(key: Normalizer.key(code, dimension, record_key), code: code, severity: severity,
+          dimension: dimension, record_key: record_key, details: details)
+      end
+    end
+  end
+end

data/lib/netstack/wireless/authentication_connection.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Wireless
+    class AuthenticationConnection < Data.define(:key, :kind, :mac_address, :ap_name, :ap_id, :radio_id, :bssid, :ssid, :username, :ip_address, :interface, :domain, :protocol, :state, :initial_vlan_id, :authorized_vlan_id, :online_seconds)
+      def initialize(key:, kind:, mac_address:, ap_name: nil, ap_id: nil, radio_id: nil, bssid: nil, ssid: nil, username: nil, ip_address: nil, interface: nil, domain: nil, protocol: nil, state: nil, initial_vlan_id: nil, authorized_vlan_id: nil, online_seconds: nil)
+        key = Values.text(key, name: "wireless record key")
+        super(**Values.copy(key: key, kind: kind, mac_address: mac_address, ap_name: ap_name, ap_id: ap_id, radio_id: radio_id, bssid: bssid, ssid: ssid, username: username, ip_address: ip_address, interface: interface, domain: domain, protocol: protocol, state: state, initial_vlan_id: initial_vlan_id, authorized_vlan_id: authorized_vlan_id, online_seconds: online_seconds))
+      end
+    end
+  end
+end

data/lib/netstack/wireless/bss.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Wireless
+    class Bss < Data.define(:key, :bssid, :ap_name, :ap_id, :radio_id, :ssid, :service_template, :vlan_id, :state, :client_count, :security)
+      def initialize(key:, bssid:, ap_name: nil, ap_id: nil, radio_id: nil, ssid: nil, service_template: nil, vlan_id: nil, state: nil, client_count: nil, security: {})
+        key = Values.text(key, name: "wireless record key")
+        super(**Values.copy(key: key, bssid: bssid, ap_name: ap_name, ap_id: ap_id, radio_id: radio_id, ssid: ssid, service_template: service_template, vlan_id: vlan_id, state: state, client_count: client_count, security: security))
+      end
+    end
+  end
+end

data/lib/netstack/wireless/client.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Wireless
+    class Client < Data.define(:key, :mac_address, :ap_name, :ap_id, :radio_id, :bssid, :ssid, :ip_address, :ipv6_address, :vlan_id, :rssi, :rssi_scale, :online_seconds, :rx_rate_bps, :tx_rate_bps, :authentication, :terminal, :attributes)
+      def initialize(key:, mac_address:, ap_name: nil, ap_id: nil, radio_id: nil, bssid: nil, ssid: nil, ip_address: nil, ipv6_address: nil, vlan_id: nil, rssi: nil, rssi_scale: nil, online_seconds: nil, rx_rate_bps: nil, tx_rate_bps: nil, authentication: {}, terminal: {}, attributes: {})
+        key = Values.text(key, name: "wireless record key")
+        super(**Values.copy(key: key, mac_address: mac_address, ap_name: ap_name, ap_id: ap_id, radio_id: radio_id, bssid: bssid, ssid: ssid, ip_address: ip_address, ipv6_address: ipv6_address, vlan_id: vlan_id, rssi: rssi, rssi_scale: rssi_scale, online_seconds: online_seconds, rx_rate_bps: rx_rate_bps, tx_rate_bps: tx_rate_bps, authentication: authentication, terminal: terminal, attributes: attributes))
+      end
+    end
+  end
+end

data/lib/netstack/wireless/collector.rb

@@ -0,0 +1,191 @@
+# frozen_string_literal: true
+
+require "digest"
+
+module Netstack
+  # 控制器观察、保留状态与评估；各维度分别记录证据。
+  module Wireless
+    # One controller, sequential read-only CLI. The caller owns credentials, scheduling and persistence.
+    class Collector
+      H3C_COMMANDS = {
+        access_points: "display wlan ap all verbose", radios: "display wlan ap all verbose",
+        clients: "display wlan client verbose", bsses: "display wlan bss all verbose",
+        dot1x_connections: "display dot1x connection", mab_connections: "display mac-authentication connection",
+        blocked_clients: "display wlan client-security block-mac",
+        configuration: "display current-configuration", ap_groups: "display current-configuration", service_templates: "display current-configuration"
+      }.freeze
+      HUAWEI_COMMANDS = { access_points: "display ap all", clients: "display station all" }.freeze
+      DEFAULT_DIMENSIONS = (Snapshot::DIMENSIONS - [:lldp]).freeze
+
+      def initialize(connector_factory: nil, clock: -> { Time.now.utc }, evidence_writer: nil)
+        @connector_factory = connector_factory
+        @clock = clock
+        @evidence_writer = evidence_writer
+      end
+
+      # 传入的控制器连接仍归调用者管理；通过工厂创建的
+      # 控制器和 AP 会话由此处关闭；原始证据仅在显式启用时保存。
+      def call(target:, dimensions: DEFAULT_DIMENSIONS, connector: nil, ap_connector_factory: nil)
+        raise InputError, "wireless collection target must be a Target" unless target.is_a?(Target)
+        raise InputError, "wireless dimensions must be an Array" unless dimensions.is_a?(Array)
+        raise InputError, "invalid wireless dimension name" unless dimensions.all? { |name| name.is_a?(Symbol) || name.is_a?(String) }
+        requested = dimensions.map(&:to_sym).uniq
+        raise InputError, "unknown wireless collection dimension" unless (requested - Snapshot::DIMENSIONS).empty?
+        platform = platform_for(target)
+        requested |= [:access_points] if requested.include?(:lldp)
+        requested |= [:configuration] unless (requested & %i[ap_groups service_templates]).empty?
+        commands = platform == :h3c ? H3C_COMMANDS : platform == :huawei ? HUAWEI_COMMANDS : {}
+        collected = []
+        cache = {}
+        owned = connector.nil?
+        connection_error = nil
+        if commands.any? && requested.any? { |name| commands.key?(name) }
+          begin
+            connector ||= @connector_factory&.call(target)
+            raise InputError, "wireless connector is required" unless connector
+            connector.connect if owned
+          rescue StandardError => error
+            connection_error = error_code(error)
+          end
+        end
+        requested.each do |name|
+          next if name == :lldp
+          unless commands.key?(name)
+            collected << unavailable(name, :unsupported, :unsupported_platform_dimension)
+            next
+          end
+          if connection_error
+            collected << unavailable(name, :failed, connection_error)
+            next
+          end
+          command = commands.fetch(name)
+          observation = cache[command] ||= read(connector, target, command)
+          collected << parse_observation(name, platform, observation)
+        end
+        if requested.include?(:lldp)
+          collected << collect_lldp(target, platform, collected, ap_connector_factory)
+        end
+        Snapshot.new(target: target, dimensions: collected, observed_at: now)
+      ensure
+        original_error = $!
+        if owned && connector
+          begin
+            connector.close
+          rescue StandardError
+            raise Error.new("wireless session cleanup failed", code: :cleanup_failed, stage: :collect) unless original_error
+          end
+        end
+      end
+
+      private
+
+      def platform_for(target)
+        case target.platform.to_s.downcase
+        when "h3c", "h3c_wireless" then :h3c
+        when "huawei" then :huawei
+        else :unsupported
+        end
+      end
+
+      def now = Values.time(@clock.call, name: "wireless collection clock")
+
+      def unavailable(name, status, code)
+        time = now
+        Dimension.new(name: name, status: status, started_at: time, completed_at: time, diagnostics: [{ code: code }])
+      end
+
+      def read(connector, target, command)
+        started_at = now
+        prompt = connector.current_prompt
+        raise InputError, "wireless collection requires a confirmed prompt" unless prompt.is_a?(String) && !prompt.empty?
+
+        exact_prompt = /(?:\A|(?<=[\r\n]))[ \t\x00]*#{Regexp.escape(prompt)}[ \t\x00]*[\r\n]*\z/
+        result = connector.execute_operation(Connector::Script.new([Connector::Command.new(command, output_sensitive: true)]),
+          name: :wireless_collection, prompt: exact_prompt, privilege: false)
+        raw = result.output
+        evidence = { command: command, sha256: Digest::SHA256.hexdigest(raw), bytes: raw.bytesize }
+        if @evidence_writer
+          evidence[:reference] = Values.copy(@evidence_writer.call(target: target, command: command, output: raw))
+        end
+        return { started_at: started_at, completed_at: now, evidence: [evidence], error: error_code(result.error) } unless result.success?
+
+        step = result.steps.last
+        raise InputError, "wireless collection has no completed command" unless step
+        body = Connector::TerminalRenderer.render(step.output.delete_suffix(step.prompt.to_s))
+        lines = body.lines
+        lines.shift while lines.first&.strip == ""
+        lines.shift if lines.first&.strip == command
+        { text: lines.join, started_at: started_at, completed_at: now, evidence: [evidence] }
+      rescue StandardError => error
+        { started_at: started_at || now, completed_at: now, evidence: [], error: error_code(error) }
+      end
+
+      def parse_observation(name, platform, observation)
+        metadata = observation.slice(:started_at, :completed_at, :evidence)
+        return Dimension.new(name: name, status: :failed, diagnostics: [{ code: observation[:error] }], **metadata) if observation[:error]
+
+        parsed = if %i[configuration ap_groups service_templates].include?(name)
+          H3c::ConfigParser.new.parse(observation.fetch(:text), terminated: true)
+        else
+          parser = platform == :h3c ? H3c::RuntimeParser.new : Huawei::RuntimeParser.new
+          parser.parse(name, observation.fetch(:text), terminated: true)
+        end
+        records = parsed.records
+        records = records.first&.public_send(name) || [] if %i[ap_groups service_templates].include?(name)
+        records = [] if parsed.status == :failed
+        Dimension.new(name: name, status: parsed.status, records: records, diagnostics: parsed.diagnostics, **metadata)
+      end
+
+      def collect_lldp(target, platform, collected, factory)
+        return unavailable(:lldp, :unsupported, :unsupported_platform_dimension) unless platform == :h3c
+        return unavailable(:lldp, :failed, :ap_connector_required) unless factory
+
+        aps = collected.find { |dimension| dimension.name == :access_points }
+        return unavailable(:lldp, :failed, :access_points_unavailable) if aps.unavailable?
+
+        started_at = now
+        records = []
+        evidence = []
+        diagnostics = []
+        complete = aps.complete?
+        aps.records.each do |ap|
+          device = nil
+          begin
+            device = factory.call(target, ap)
+            raise InputError, "AP connector unavailable" unless device
+            device.connect
+            observation = read(device, target, "display lldp neighbor-information verbose")
+            evidence.concat(observation[:evidence].map { |item| item.merge(ap_name: ap.name) })
+            if observation[:error]
+              complete = false
+              diagnostics << { code: observation[:error], ap_name: ap.name }
+              next
+            end
+            parsed = H3c::LldpParser.new.parse(observation.fetch(:text), ap_name: ap.name, terminated: true)
+            complete &&= parsed.status == :complete
+            records.concat(parsed.records)
+            diagnostics.concat(parsed.diagnostics.map { |item| item.merge(ap_name: ap.name) })
+          rescue StandardError => error
+            complete = false
+            diagnostics << { code: error_code(error), ap_name: ap.name }
+          ensure
+            begin
+              device&.close
+            rescue StandardError
+              complete = false
+              diagnostics << { code: :cleanup_failed, ap_name: ap.name }
+            end
+          end
+        end
+        diagnostics << { code: :partial_access_point_coverage } unless aps.complete?
+        status = complete ? :complete : records.empty? ? :failed : :partial
+        Dimension.new(name: :lldp, status: status, records: records, started_at: started_at, completed_at: now,
+          evidence: evidence, diagnostics: diagnostics)
+      end
+
+      def error_code(error)
+        error.respond_to?(:code) && error.code.is_a?(Symbol) ? error.code : :collection_failed
+      end
+    end
+  end
+end

data/lib/netstack/wireless/configuration.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Wireless
+    # 控制器配置的结构化观察；完整性由外层 Dimension 表达，不能从空集合推断。
+    class Configuration < Data.define(:key, :access_points, :ap_groups, :service_templates, :global_settings, :blacklist, :whitelist)
+      def initialize(key: "controller", access_points: {}, ap_groups: [], service_templates: [], global_settings: {}, blacklist: [], whitelist: [])
+        super(**Values.copy(key: key, access_points: access_points, ap_groups: ap_groups, service_templates: service_templates,
+          global_settings: global_settings, blacklist: blacklist, whitelist: whitelist))
+      end
+    end
+  end
+end

data/lib/netstack/wireless/finding.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Wireless
+    class Finding < Data.define(:key, :code, :severity, :dimension, :record_key, :details)
+      def initialize(key:, code:, severity:, dimension:, record_key: nil, details: {})
+        key = Values.text(key, name: "wireless record key")
+        super(**Values.copy(key: key, code: code, severity: severity, dimension: dimension, record_key: record_key, details: details))
+      end
+    end
+  end
+end

data/lib/netstack/wireless/h3c/config_parser.rb

@@ -0,0 +1,229 @@
+# frozen_string_literal: true
+
+module Netstack
+  module Wireless
+    module H3c
+      # Wireless sections only. Unknown wireless statements remain visible without copying secrets.
+      class ConfigParser
+        # rubocop:disable Naming/PredicateMethod -- These methods consume a line and mutate the current parse record.
+        def parse(content, terminated: false)
+          reader = Netstack::Configuration::Reader.new(Normalizer.text(content), vendor: "h3c")
+          aps = {}
+          groups = {}
+          templates = {}
+          global = {}
+          lists = { blacklist: [], whitelist: [] }
+          diagnostics = []
+          section = kind = radio = model = nil
+          recognized = false
+          reader.lines.each_with_index do |raw, index|
+            line = raw.strip
+            next if line.empty?
+            if line == "#"
+              section = kind = radio = model = nil
+              next
+            end
+            begin
+              if (match = /\Awlan ap-group (\S+)(?: type (.+))?\z/i.match(line))
+                name = match[1]
+                raise InputError, "duplicate AP group" if groups.key?(name)
+                section = groups[name] = { name: name, ap_names: [], serial_ids: [], vlan_ids: [], model_profiles: {}, configuration: {} }
+                section[:configuration][:type] = match[2] if match[2]
+                kind = :group
+                radio = model = nil
+                recognized = true
+              elsif (match = /\Awlan ap (\S+) model (.+)\z/i.match(line))
+                name = match[1]
+                raise InputError, "duplicate configured AP" if aps.key?(name)
+                section = aps[name] = { name: name, model: match[2], radios: {} }
+                kind = :ap
+                radio = model = nil
+                recognized = true
+              elsif (match = /\Awlan service-template (\S+)\z/i.match(line))
+                name = match[1]
+                raise InputError, "duplicate service template" if templates.key?(name)
+                section = templates[name] = { name: name, akm_modes: [], cipher_suites: [], security_ies: [] }
+                kind = :template
+                radio = model = nil
+                recognized = true
+              elsif /\A(?:undo )?(?:wlan|dot1x|mac-authentication)\b/i.match?(line) && !section && !/\A\s/.match?(raw)
+                recognized = true
+                unknown(diagnostics, index) unless global_line(global, lists, line)
+              elsif section
+                if kind == :group && (match = /\Aap-model (.+)\z/i.match(line))
+                  model = section[:model_profiles][match[1]] ||= { radios: {} }
+                  radio = nil
+                elsif %i[ap group].include?(kind) && (match = /\Aradio (\d+)\z/i.match(line))
+                  parent = kind == :ap ? section : model
+                  raise InputError, "group radio requires AP model" unless parent
+                  radio = (parent[:radios] ||= {})[match[1].to_i] ||= { service_templates: [] }
+                elsif radio
+                  unknown(diagnostics, index) unless radio_line(radio, line)
+                elsif kind == :template
+                  unknown(diagnostics, index) unless template_line(section, line)
+                elsif model
+                  if (match = /\Amap-configuration (.+)\z/i.match(line))
+                    model[:map_configuration] = match[1]
+                  else
+                    unknown(diagnostics, index)
+                  end
+                elsif kind == :ap
+                  unknown(diagnostics, index) unless ap_line(section, line)
+                else
+                  unknown(diagnostics, index) unless group_line(section, line)
+                end
+              elsif /\Areturn\z/i.match?(line)
+                recognized = true
+              end
+              reader.mark(index)
+            rescue InputError
+              diagnostics << { code: :invalid_configuration_line, line: index + 1 }
+            end
+          end
+          diagnostics << { code: :missing_completeness_evidence } unless terminated || reader.lines.any? { |line| line.strip.casecmp?("return") }
+          diagnostics << { code: :unrecognized_configuration } unless recognized
+          group_records = groups.map { |name, attributes| ApGroup.new(key: Normalizer.key(name), **attributes) }
+          template_records = templates.map do |name, attributes|
+            ServiceTemplate.new(key: Normalizer.key(name), name: name, ssid: attributes[:ssid], vlan_id: attributes[:vlan_id],
+              enabled: attributes[:enabled], authentication_type: authentication_type(attributes), configuration: attributes)
+          end
+          config = Configuration.new(access_points: aps, ap_groups: group_records, service_templates: template_records,
+            global_settings: global, **lists.transform_values { |records| records.uniq { |record| record[:mac_address] } })
+          config.access_points.each_value { |ap| ServiceTemplateBindings.validate_radios!(ap.fetch(:radios, {})) }
+          ServiceTemplateBindings.validate_groups!(config.ap_groups)
+          ParseResult.new(records: recognized ? [config] : [], status: diagnostics.empty? ? :complete : recognized ? :partial : :failed,
+            diagnostics: diagnostics)
+        rescue InputError => error
+          ParseResult.new(records: [], status: :failed, diagnostics: [{ code: :invalid_configuration, error: error.code }])
+        end
+
+        private
+
+        def unknown(diagnostics, index) = diagnostics << { code: :unrecognized_wireless_configuration, line: index + 1 }
+
+        def common_line(record, line)
+          case line
+          when /\Aclient keep-alive (enable|disable)\z/i then record[:client_keep_alive] = Regexp.last_match(1).casecmp?("enable")
+          when /\Aclient keep-alive interval (\d+)\z/i then record[:client_keep_alive_interval] = Regexp.last_match(1).to_i
+          when /\Aclient-rate-limit (enable|disable)\z/i then record[:client_rate_limit_enabled] = Regexp.last_match(1).casecmp?("enable")
+          when /\Aclient-rate-limit (inbound|outbound) mode (\S+) cir (\d+)\z/i
+            (record[:client_rate_limit] ||= {})[Regexp.last_match(1).downcase.to_sym] = { mode: Regexp.last_match(2), cir_bps: Regexp.last_match(3).to_i * 1000 }
+          else return false
+          end
+          true
+        end
+
+        def ap_line(record, line)
+          return true if common_line(record, line)
+
+          case line
+          when /\Aserial-id (\S+)\z/i then record[:serial_id] = Regexp.last_match(1)
+          when /\Adescription (.+)\z/i then record[:description] = Regexp.last_match(1)
+          when /\Avlan (\d+)\z/i then record[:vlan_id] = Normalizer.integer(Regexp.last_match(1), max: 4094)
+          when /\A(undo )?band-navigation enable\z/i then record[:band_navigation] = Regexp.last_match(1).nil?
+          when /\A(undo )?radio-load-balance band-navigation enable\z/i then record[:radio_load_balance_band_navigation] = Regexp.last_match(1).nil?
+          when /\Aclient max-count (\d+)\z/i then record[:client_max_count] = Regexp.last_match(1).to_i
+          else return false
+          end
+          true
+        end
+
+        def group_line(record, line)
+          return true if common_line(record[:configuration], line)
+
+          case line
+          when /\Avlan (\d+)\z/i then record[:vlan_ids] << Normalizer.integer(Regexp.last_match(1), max: 4094)
+          when /\Aserial-id (\S+)\z/i then record[:serial_ids] << Regexp.last_match(1)
+          when /\Aap (\S+)\z/i then record[:ap_names] << Regexp.last_match(1)
+          when /\Awlan tunnel-preempt enable\z/i then record[:configuration][:tunnel_preempt] = true
+          when /\Abroadcast-probe reply disable\z/i then record[:configuration][:broadcast_probe_reply] = false
+          when /\Abackup-ac ip (\S+)\z/i then record[:configuration][:backup_ac_ip] = Normalizer.ip(Regexp.last_match(1))
+          else return false
+          end
+          true
+        end
+
+        def radio_line(record, line)
+          return true if common_line(record, line)
+
+          case line
+          when /\Achannel band-width (.+)\z/i then record[:channel_bandwidth] = Regexp.last_match(1)
+          when /\Amax-power (\d+(?:\.\d+)?)\z/i then record[:max_power] = Float(Regexp.last_match(1))
+          when /\Aradio (enable|disable)\z/i then record[:enabled] = Regexp.last_match(1).casecmp?("enable")
+          when /\Achannel (.+)\z/i
+            record[:channel] = Regexp.last_match(1)
+            record[:channel_number] = Normalizer.channel(record[:channel])
+          when /\Aradar-detect disable\z/i then record[:radar_detect_disabled] = true
+          when /\Asacp anti-sticky enable(?: rssi (-?\d+(?:\.\d+)?))? interval (\d+)\z/i
+            record[:anti_sticky] = { enabled: true, rssi: Regexp.last_match(1)&.to_f, interval: Regexp.last_match(2).to_i }
+          when /\Arate (mandatory|supported|disabled) (.+)\z/i
+            kind, values = Regexp.last_match.captures
+            (record[:rates] ||= {})[kind.downcase.to_sym] = values.split.map { |value| Normalizer.number(value) }
+          when /\Arate multicast (.+)\z/i then (record[:rates] ||= {})[:multicast] = Regexp.last_match(1)
+          when /\Aoption client (reject|reconnect) enable rssi (-?\d+(?:\.\d+)?)\z/i
+            (record[:client_options] ||= {})[Regexp.last_match(1).downcase.to_sym] = Float(Regexp.last_match(2))
+          when /\Aservice-template (\S+)(?: vlan (\d+))?\z/i
+            record[:service_templates] << { name: Regexp.last_match(1), vlan_id: Normalizer.integer(Regexp.last_match(2), max: 4094) }
+          else return false
+          end
+          true
+        end
+
+        def template_line(record, line)
+          return true if common_line(record, line)
+
+          case line
+          when /\A(description|ssid) (.+)\z/i then record[Regexp.last_match(1).downcase.to_sym] = Regexp.last_match(2)
+          when /\A(undo )?beacon ssid-hide\z/i then record[:ssid_hidden] = Regexp.last_match(1).nil?
+          when /\Avlan (\d+)\z/i then record[:vlan_id] = Normalizer.integer(Regexp.last_match(1), max: 4094)
+          when /\Aclient forwarding-location (\S+)\z/i then record[:forwarding_location] = Regexp.last_match(1)
+          when /\Aclient cache aging-time (\d+)\z/i then record[:client_cache_aging_time] = Regexp.last_match(1).to_i
+          when /\Apacket-filter name (\S+) (inbound|outbound)\z/i
+            (record[:packet_filters] ||= {})[Regexp.last_match(2).downcase.to_sym] = Regexp.last_match(1)
+          when /\A(undo )?bss transition-management enable\z/i then record[:btm_enabled] = Regexp.last_match(1).nil?
+          when /\Abss transition-management disassociation forced timer (\d+)\z/i then record[:btm_disassociation_timer] = Regexp.last_match(1).to_i
+          when /\Aakm mode (.+)\z/i then record[:akm_modes] |= Regexp.last_match(1).downcase.gsub("802.1x", "dot1x").split
+          when /\Acipher-suite (.+)\z/i then record[:cipher_suites] |= Regexp.last_match(1).downcase.split
+          when /\Asecurity-ie (.+)\z/i then record[:security_ies] |= Regexp.last_match(1).downcase.split
+          when /\Apreshared-key\s+.+\z/i then record[:has_preshared_key] = true
+          when /\Aclient-security authentication-mode (.+)\z/i then record[:client_security_authentication_mode] = Regexp.last_match(1).downcase
+          when /\Aclient-security (ignore-authentication|ignore-authorization)\z/i then record[Regexp.last_match(1).tr("-", "_").to_sym] = true
+          when /\Adot1x domain (\S+)\z/i then record[:dot1x_domain] = Regexp.last_match(1)
+          when /\Amac-authentication domain (\S+)\z/i then record[:mac_authentication_domain] = Regexp.last_match(1)
+          when /\Aportal (enable method|domain|bas-ip|apply web-server|apply mac-trigger-server) (\S+)\z/i
+            (record[:portal] ||= {})[Regexp.last_match(1).tr(" -", "__").to_sym] = Regexp.last_match(2)
+          when /\A(undo )?service-template enable\z/i then record[:enabled] = Regexp.last_match(1).nil?
+          else return false
+          end
+          true
+        end
+
+        def global_line(global, lists, line)
+          case line
+          when /\A(undo )?wlan (auto-ap|auto-persistent) enable\z/i then global[Regexp.last_match(2).tr("-", "_").to_sym] = Regexp.last_match(1).nil?
+          when /\A(undo )?dot1x\z/i then global[:dot1x_enabled] = Regexp.last_match(1).nil?
+          when /\Adot1x authentication-method (.+)\z/i then global[:dot1x_authentication_method] = Regexp.last_match(1)
+          when /\A(undo )?mac-authentication\z/i then global[:mac_authentication_enabled] = Regexp.last_match(1).nil?
+          when /\Amac-authentication user-name-format (.+)\z/i then global[:mac_authentication_user_name_format] = Regexp.last_match(1)
+          when /\Awlan (?:client-security )?static-(black|white)list mac-address (\S+)(?: (.+))?\z/i
+            kind, mac, reason = Regexp.last_match.captures
+            lists[kind.downcase == "black" ? :blacklist : :whitelist] << { mac_address: Normalizer.mac(mac), reason: reason }
+          else return false
+          end
+          true
+        end
+
+        def authentication_type(record)
+          mode = record[:client_security_authentication_mode]
+          return :dot1x if mode == "dot1x" || record[:akm_modes].include?("dot1x") || record[:dot1x_domain]
+          return :mab if mode == "mac" || record[:mac_authentication_domain]
+          return :psk if record[:akm_modes].include?("psk") || record[:has_preshared_key]
+          return :portal if record[:portal]&.key?(:enable_method)
+
+          nil
+        end
+        # rubocop:enable Naming/PredicateMethod
+      end
+    end
+  end
+end