netstack 0.1.1 → 0.2.0

data/lib/netstack/configuration/payload.rb

@@ -0,0 +1,168 @@
+# frozen_string_literal: true
+
+# Adapted from Motor Netconf scenario definitions and safe template dialect.
+require_relative "support"
+
+require "ipaddr"
+require "socket"
+require_relative "bootstrap/payload"
+
+module Netstack
+  module Configuration
+    class Payload
+      def self.call(scenario:, input:, system_config: {}, now: Time.now.utc)
+        data = Support.object(input).deep_dup
+        data["system"] = system_config.deep_stringify_keys if scenario.to_s == "bootstrap"
+        case scenario.to_s
+        when "bootstrap" then bootstrap(data)
+        when "h3c-irf" then irf(data)
+        when "distributed-gateway" then distributed_gateway(data)
+        when "server-port" then server_port(data)
+        when "hillstone-policy" then hillstone_policy(data, now: now)
+        when "load-balancer" then load_balancer(data)
+        when "ipsec-vpn" then ipsec(data)
+        end
+        data
+      end
+
+      class << self
+        include Bootstrap::Payload
+
+        private
+
+        def irf(data)
+          range = IPAddr.new(data.fetch("mad_subnet")).to_range
+          data.merge!("mad_mask" => mask(data.fetch("mad_subnet")), "mad_member1_ip" => ipv4(range.first.to_i + 1), "mad_member2_ip" => ipv4(range.first.to_i + 2))
+        end
+
+        def server_port(data)
+          data.fetch("allocations").each { |row| decorate_switchport(row) }
+          data["aggregates"] = data.fetch("allocations").select { |row| row["port_channel"] }.group_by { |row| row["aggregate_id"] }.map { |id, rows| rows.first.merge("aggregate_id" => id) }
+          data["aggregates"].each { |row| row["vpc"] = data.fetch("stack_mode") == "vpc" }
+        end
+
+        def distributed_gateway(data)
+          data.fetch("gateways").each { |row| row["gateway_cidr"] = "#{row.fetch("gateway")}/#{row.fetch("subnet").split("/").last}" }
+        end
+
+        def hillstone_policy(data, now:)
+          policies = data.fetch("policies")
+          data["address_objects"] = []
+          service_index = {}
+          generated_date = now.strftime("%Y%m%d")
+
+          policies.each_with_index do |policy, index|
+            sequence = index + 1
+            policy["object_key"] = format("POLICY_%s_%03d", generated_date, sequence)
+            policy["description"] = policy["description"].presence || format("%s-%03d", generated_date, sequence)
+            policy["has_description"] = true
+            decorate_policy_addresses(data, policy, "src")
+            decorate_policy_addresses(data, policy, "dst")
+
+            policy["service_any"] = policy.fetch("services") == [ "any" ]
+            policy["service_names"] = []
+            policy["service_group"] = nil
+            next if policy["service_any"]
+
+            policy["service_names"] = policy.fetch("services").map do |ports|
+              name = hillstone_object_name(policy.fetch("protocol"), ports)
+              service_index[name] ||= hillstone_service(name, policy.fetch("protocol"), ports)
+              name
+            end
+            if policy["service_names"].size > 3
+              policy["service_group"] = hillstone_object_name(policy.fetch("object_key"), "SVC")
+            end
+          end
+
+          data["service_objects"] = service_index.values
+          data["service_groups"] = policies.filter_map do |policy|
+            next unless policy["service_group"]
+            { "name" => policy.fetch("service_group"), "services" => policy.fetch("service_names") }
+          end
+        end
+
+        def decorate_policy_addresses(data, policy, side)
+          addresses = policy.fetch("#{side}_addresses")
+          policy["#{side}_any"] = addresses == [ "any" ]
+          policy["#{side}_object"] = nil
+          policy["#{side}_entries"] = []
+          return if policy["#{side}_any"]
+
+          entries = addresses.map { |address| hillstone_address_entry(address) }
+          if entries.size > 3
+            object_name = hillstone_object_name(policy.fetch("object_key"), side.upcase)
+            policy["#{side}_object"] = object_name
+            data.fetch("address_objects") << { "name" => object_name, "entries" => entries }
+          else
+            policy["#{side}_entries"] = entries
+          end
+        end
+
+        def hillstone_address_entry(address)
+          return { "range" => false, "value" => address } unless address.include?("-")
+          first, last = address.split("-", 2)
+          { "range" => true, "first" => first, "last" => last }
+        end
+
+        def hillstone_service(name, protocol, ports)
+          bounds = ports.split("-", 2)
+          { "name" => name, "protocol" => protocol, "first_port" => bounds.first,
+            "last_port" => bounds.last || bounds.first, "port_range" => bounds.size == 2 }
+        end
+
+        def hillstone_object_name(*parts)
+          parts.join("_").upcase
+        end
+
+        def load_balancer(data)
+          services = data.fetch("services")
+          data["real_servers"] = services.flat_map { |row| row.fetch("real_ips") }.uniq.map { |address| { "address" => address } }
+          data["groups"] = services.group_by { |row| row.fetch("group_name").downcase }.values.map do |rows|
+            rows.first.slice("group_name", "real_ips", "health_check")
+          end
+          services.each { |row| row["client_ip_persistence"] = row.fetch("client_ip_persistence", false) }
+          data["virtuals"] = services.group_by { |row| [ row.fetch("flag"), row.fetch("virtual_ip") ] }.map do |(flag, virtual_ip), rows|
+            { "virtual_ip" => virtual_ip, "virtual_name" => "VIP_#{flag}_#{virtual_ip}", "services" => rows }
+          end
+        end
+
+        def ipsec(data)
+          data["ikev1"] = data.fetch("ike_version") == "ikev1"
+          data["ikev2"] = data.fetch("ike_version") == "ikev2"
+          data["local_ip"] = data["local_address"]&.split("/")&.first
+          encryption = { "aes-256-cbc" => "aes-256", "3des" => "3des" }
+          authentication = { "sha256" => "sha256", "sha1" => "sha", "md5" => "md5" }
+          data["hillstone_ike_encryption"] = encryption[data.fetch("ike_encryption")]
+          data["hillstone_ipsec_encryption"] = encryption[data.fetch("ipsec_encryption")]
+          data["hillstone_ikev2_encryption"] = data["hillstone_ike_encryption"]&.delete("-")
+          data["hillstone_ipsec_v2_encryption"] = data["hillstone_ipsec_encryption"]&.delete("-")
+          data["hillstone_ike_hash"] = authentication.fetch(data.fetch("ike_authentication"))
+          data["hillstone_ipsec_hash"] = authentication.fetch(data.fetch("ipsec_authentication"))
+          data["hillstone_ike_group"] = data.fetch("ike_dh_group").delete_prefix("group")
+          data["proxy_ids"] = data.fetch("local_subnets").product(data.fetch("remote_subnets")).map.with_index { |(local, remote), index| { "name" => "proxy-#{index + 1}", "local" => local, "remote" => remote } }
+          data["routes"] = data.fetch("remote_subnets").map.with_index { |subnet, index| { "name" => "#{data.fetch("site_name")}-#{index + 1}", "subnet" => subnet } }
+        end
+
+        def mask(cidr) = IPAddr.new("255.255.255.255").mask(cidr.split("/").last.to_i).to_s
+        def ipv4(number) = IPAddr.new(number, Socket::AF_INET).to_s
+
+        def entries(addresses)
+          addresses.map.with_index { |address, index| { "address" => address, "role" => index.zero? ? "primary" : "secondary", "name" => "SERVER#{index + 1}" } }
+        end
+
+        def wildcard(cidr)
+          network = IPAddr.new(cidr)
+          mask_value = IPAddr.new("255.255.255.255").mask(cidr.split("/").last.to_i)
+          "#{network.to_range.first} #{ipv4(mask_value.to_i ^ 0xffffffff)}"
+        end
+
+        def decorate_switchport(row)
+          row["trunk_all"] = row["vlan"] == "trunk"
+          row["trunk_list"] = !row["trunk_all"] && row["vlan"].match?(/[,-]/)
+          row["access"] = !row["trunk_all"] && !row["trunk_list"]
+          row["vlan_space"] = row["vlan"].tr(",", " ").gsub("-", " to ")
+        end
+      end
+    end
+  end
+end

data/lib/netstack/configuration/reader.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+require "digest"
+require "active_support/core_ext/object/blank"
+
+module Netstack
+  module Configuration
+    # Source bytes and line endings are immutable; consumption belongs to this reader only.
+    class Reader
+      attr_reader :content, :lines, :vendor, :device_id, :device_name, :created_at, :checksum, :position
+
+      def initialize(content, vendor: nil, device_id: nil, device_name: nil, created_at: Time.now.utc)
+        raise ArgumentError, "Configuration content must be a string" unless content.is_a?(String)
+
+        @content = content.dup
+        unless [Encoding::UTF_8, Encoding::BINARY, Encoding::US_ASCII].include?(@content.encoding)
+          raise EncodingError, "Configuration must contain UTF-8 bytes"
+        end
+        @content.force_encoding(Encoding::UTF_8)
+        raise EncodingError, "Configuration is not valid UTF-8" unless @content.valid_encoding?
+        raise ArgumentError, "Configuration contains a NUL byte" if @content.include?("\0")
+
+        @content.freeze
+        @vendor = vendor.nil? ? nil : identifier(vendor, "Vendor").downcase.tr(" -", "__").freeze
+        @device_id = device_id.nil? ? nil : identifier(device_id, "Device ID")
+        @device_name = device_name.nil? ? nil : identifier(device_name, "Device name")
+        raise ArgumentError, "Creation time must be a Time" unless created_at.is_a?(Time)
+
+        @created_at = created_at.dup.freeze
+        @lines = @content.scan(/[^\r\n]*(?:\r\n|\r|\n)|[^\r\n]+\z/).map(&:freeze).freeze
+        @checksum = Digest::SHA256.hexdigest(@content).freeze
+        reset!
+      end
+
+      def size = lines.size
+      def inspect = "#<#{self.class.name} bytes=#{content.bytesize} lines=#{size} checksum=#{checksum}>"
+      def parsed_flags = @parsed.dup.freeze
+      def parsed?(index) = valid_index?(index) ? @parsed[index] : nil
+
+      def mark(index, parsed: true)
+        raise IndexError, "Line index is outside the document" unless valid_index?(index)
+        raise ArgumentError, "Parsed flag must be true or false" unless parsed == true || parsed == false
+
+        @parsed[index] = parsed
+        self
+      end
+
+      def rewind
+        @position = 0
+        self
+      end
+
+      def reset!
+        @parsed = Array.new(size, false)
+        rewind
+      end
+
+      def read
+        return nil if position >= size
+
+        line = lines[position]
+        @position += 1
+        line
+      end
+
+      def read_pending
+        while position < size
+          index = position
+          line = read
+          next if @parsed[index]
+
+          @parsed[index] = true
+          line = line.chomp
+          next if line.blank?
+
+          return line.freeze
+        end
+        nil
+      end
+
+      # Cursor commands return whether they changed state, rather than answering a predicate.
+      # rubocop:disable Naming/PredicateMethod
+      def step_back
+        return false if position.zero?
+
+        @position -= 1
+        true
+      end
+
+      def unread
+        return false unless step_back
+
+        @parsed[position] = false
+        true
+      end
+
+      def defer
+        return false if position.zero?
+
+        @parsed[position - 1] = false
+        true
+      end
+      # rubocop:enable Naming/PredicateMethod
+
+      def unparsed_lines = lines.each_index.filter_map { |index| lines[index] unless @parsed[index] }.freeze
+      def unparsed_content = unparsed_lines.join.freeze
+
+      private
+
+      def valid_index?(index) = index.is_a?(Integer) && index >= 0 && index < size
+
+      def identifier(value, label)
+        text = case value
+        when String then value
+        when Symbol then value.to_s
+        when Integer then value.to_s if value >= 0
+        end
+        raise ArgumentError, "#{label} must be nonempty text or a nonnegative integer" unless text && !text.strip.empty?
+
+        text.dup.freeze
+      end
+    end
+  end
+end

data/lib/netstack/configuration/support.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require "active_support/core_ext/object/blank"
+require "active_support/core_ext/object/deep_dup"
+require "active_support/core_ext/object/inclusion"
+require "active_support/core_ext/hash/keys"
+require "active_support/core_ext/enumerable"
+require "active_support/core_ext/string/access"
+
+module Netstack
+  module Configuration
+    # Shared framework extensions, without loading Rails or Active Record.
+    module Support
+      def self.object(value, name: "input")
+        raise InputError, "#{name} must be an object" unless value.is_a?(Hash)
+        duplicate = value.keys.map(&:to_s).tally.values.any? { |count| count > 1 }
+        raise InputError, "#{name} contains duplicate field names" if duplicate
+
+        value.to_h do |key, item|
+          normalized = case item
+          when Hash then object(item, name: name)
+          when Array then item.map { |element| element.is_a?(Hash) ? object(element, name: name) : Values.copy(element) }
+          else Values.copy(item)
+          end
+          [key.to_s, normalized]
+        end
+      end
+    end
+  end
+end

data/lib/netstack/configuration/system_configuration.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require_relative "support"
+
+module Netstack
+  module Configuration
+    class SystemConfiguration
+      REQUIRED_FIELDS = %w[domain_name timezone management_vlan ntp_servers dns_servers syslog_servers
+        snmp_community tacacs_servers tacacs_secret ssh_acl_cidrs local_users base_security_enabled
+        disable_telnet disable_http enable_bpdu_protection password_min_length vty_timeout_minutes].freeze
+      OPTIONAL_FIELDS = %w[radius_servers radius_secret].freeze
+      FIELDS = (REQUIRED_FIELDS + OPTIONAL_FIELDS).freeze
+      SECRET_FIELDS = %w[snmp_community tacacs_secret radius_secret].freeze
+
+      def self.resolve(overrides, defaults: {})
+        current = Support.object(defaults, name: "system defaults")
+        incoming = Support.object(overrides, name: "system")
+        unexpected = (current.keys | incoming.keys) - FIELDS
+        raise InputError, "unexpected system fields: #{unexpected.join(", ")}" if unexpected.any?
+
+        SECRET_FIELDS.each do |field|
+          [current, incoming].each do |values|
+            value = values[field]
+            raise InputError, "system #{field} must be a string" unless value.nil? || value.is_a?(String)
+          end
+          incoming.delete(field) if omitted_secret?(incoming[field])
+        end
+        if incoming.key?("local_users")
+          raise InputError, "system local users must be an array" unless incoming["local_users"].is_a?(Array)
+
+          saved = Array(current["local_users"]).to_h { |user| [user.fetch("username"), user] }
+          incoming["local_users"] = incoming["local_users"].map do |user|
+            normalized = Support.object(user, name: "system local user")
+            normalized["password"] = saved.dig(normalized["username"], "password") if omitted_secret?(normalized["password"])
+            normalized
+          end
+        end
+        result = current.merge(incoming)
+        missing = REQUIRED_FIELDS.select { |field| result[field].nil? || (result[field].respond_to?(:empty?) && result[field].empty?) }
+        raise InputError, "system configuration is incomplete: #{missing.join(", ")}" if missing.any?
+
+        result
+      end
+
+      def self.frontend_defaults(config)
+        result = Support.object(config, name: "system")
+        SECRET_FIELDS.each { |field| result[field] = "" }
+        result["local_users"] = Array(result["local_users"]).map { |user| user.merge("password" => "") }
+        result
+      end
+
+      def self.omitted_secret?(value) = value.nil? || (value.is_a?(String) && value.blank?)
+      private_class_method :omitted_secret?
+    end
+  end
+end

data/lib/netstack/configuration/template_manager.rb

@@ -0,0 +1,174 @@
+# frozen_string_literal: true
+
+# Adapted from Motor Netconf scenario definitions and safe template dialect.
+require_relative "support"
+
+module Netstack
+  module Configuration
+    # A deliberately small, safe ERB dialect: interpolation, collection loops and
+    # boolean conditionals only. It never evaluates Ruby code.
+    class TemplateManager
+      Error = Class.new(Netstack::InputError)
+      TOKEN = /(<%=?[\s\S]*?%>)/
+      PATH = /\A[a-z_][a-z0-9_]*(?:\.[a-z_][a-z0-9_]*)*\z/i
+      EACH = /\A([a-z_][a-z0-9_.]*)\.each\s+do\s+\|([a-z_][a-z0-9_]*)\|\z/i
+      IF = /\Aif\s+([a-z_][a-z0-9_.]*)\z/i
+      MAX_SOURCE_BYTES = 1_048_576
+      MAX_OUTPUT_BYTES = 16_777_216
+      MAX_DEPTH = 32
+      MAX_RENDER_STEPS = 1_000_000
+
+      attr_reader :template_name, :data
+
+      def initialize(template_name, data, source: nil, store: TemplateStore.new)
+        name = template_name.to_s
+        @template_name = name.end_with?(".erb") ? name : "#{name}.erb"
+        @data = Values.copy(Support.object(data, name: "template data"))
+        @source = source
+        @store = store
+      end
+
+      def generate
+        nodes = self.class.parse(@source || @store.fetch(@template_name))
+        output = +""
+        render_nodes(nodes, @data, output, [MAX_RENDER_STEPS])
+        output
+      end
+
+      def inspect = "#<#{self.class.name} template=#{template_name.inspect}>"
+
+      def self.validate!(source, variables: nil)
+        nodes = parse(source)
+        validate_variables!(nodes, variables.map(&:to_s), []) if variables
+        nodes
+      end
+
+      def self.validate_variables!(nodes, variables, locals)
+        nodes.each do |type, *parts|
+          case type
+          when :value
+            validate_root!(parts[0], variables, locals)
+          when :each
+            collection, variable, children = parts
+            validate_root!(collection, variables, locals)
+            validate_variables!(children, variables, locals + [ variable ])
+          when :if
+            expression, truthy, falsy = parts
+            validate_root!(expression, variables, locals)
+            validate_variables!(truthy, variables, locals)
+            validate_variables!(falsy, variables, locals)
+          end
+        end
+      end
+
+      def self.validate_root!(path, variables, locals)
+        root = path.split(".").first
+        raise Error, "unknown template variable: #{root}" unless variables.include?(root) || locals.include?(root)
+      end
+      private_class_method :validate_variables!, :validate_root!
+
+      def self.parse(source)
+        raise Error, "template must be UTF-8 text" unless source.is_a?(String) && source.valid_encoding?
+        raise Error, "template exceeds the byte limit" if source.bytesize > MAX_SOURCE_BYTES
+
+        root = []
+        frames = [ { type: :root, nodes: root } ]
+        source.split(TOKEN).reject(&:empty?).each do |token|
+          raise Error, "unclosed template delimiter" if token.start_with?("<%") && !token.end_with?("%>")
+
+          if token.start_with?("<%=")
+            expression = token.delete_prefix("<%=").delete_suffix("%>").strip
+            validate_path!(expression)
+            frames.last.fetch(:nodes) << [ :value, expression ]
+          elsif token.start_with?("<%")
+            parse_directive!(token.delete_prefix("<%").delete_suffix("%>").strip, frames)
+          else
+            raise Error, "invalid template delimiter" if token.include?("<%") || token.include?("%>")
+
+            frames.last.fetch(:nodes) << [ :text, token ]
+          end
+          raise Error, "template nesting exceeds the limit" if frames.size > MAX_DEPTH
+        end
+        raise Error, "template block is not closed" unless frames.one?
+        root
+      end
+
+      def self.parse_directive!(directive, frames)
+        if (match = EACH.match(directive))
+          node = [ :each, match[1], match[2], [] ]
+          frames.last.fetch(:nodes) << node
+          frames << { type: :each, nodes: node[3] }
+        elsif (match = IF.match(directive))
+          node = [ :if, match[1], [], [] ]
+          frames.last.fetch(:nodes) << node
+          frames << { type: :if, nodes: node[2], node: node }
+        elsif directive == "else"
+          frame = frames.last
+          raise Error, "else must belong to an if block" unless frame[:type] == :if && !frame[:else]
+          frame[:else] = true
+          frame[:nodes] = frame.fetch(:node)[3]
+        elsif directive == "end"
+          raise Error, "unexpected end" if frames.one?
+          frames.pop
+        else
+          raise Error, "unsupported template expression"
+        end
+      end
+
+      def self.validate_path!(path)
+        raise Error, "invalid template variable" unless PATH.match?(path)
+      end
+      private_class_method :parse_directive!, :validate_path!
+
+      private
+
+      def render_nodes(nodes, context, output, budget)
+        nodes.each do |type, *parts|
+          consume_work!(budget)
+          case type
+          when :text then append!(output, parts[0])
+          when :value
+            value = resolve(parts[0], context)
+            unless value.nil? || value.is_a?(String) || value.is_a?(Numeric) || [true, false].include?(value)
+              raise Error, "interpolation must resolve to a scalar"
+            end
+            append!(output, value.to_s)
+          when :each
+            collection, variable, children = parts
+            items = resolve(collection, context)
+            raise Error, "template collection must be an array" unless items.is_a?(Array)
+
+            items.each do |item|
+              consume_work!(budget)
+              render_nodes(children, context.merge(variable => item), output, budget)
+            end
+          when :if
+            expression, truthy, falsy = parts
+            render_nodes(resolve(expression, context) ? truthy : falsy, context, output, budget)
+          end
+        end
+      end
+
+      def consume_work!(budget)
+        budget[0] -= 1
+        raise Error, "template rendering exceeds the work limit" if budget[0].negative?
+      end
+
+      def append!(output, value)
+        raise Error, "rendered output exceeds the byte limit" if output.bytesize + value.bytesize > MAX_OUTPUT_BYTES
+
+        output << value
+      end
+
+      def resolve(path, context)
+        segments = path.split(".")
+        segments.drop(1).reduce(context.fetch(segments.first)) do |value, segment|
+          raise Error, "#{path} does not resolve to template data" unless value.is_a?(Hash)
+          value.fetch(segment)
+        end
+      rescue KeyError
+        raise Error, "missing template data: #{path}"
+      end
+    end
+  end
+end

data/lib/netstack/configuration/template_store.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require "digest"
+require_relative "support"
+
+module Netstack
+  module Configuration
+    # 不可变模板快照；基于数据库的模板版本管理由宿主负责。
+    class TemplateStore
+      Error = Class.new(Netstack::InputError)
+      ROOT = File.expand_path("../../../resources/configuration", __dir__).freeze
+
+      # 构造时显式读取随包文件；预加载该类不会读取模板。
+      # 覆盖模板经过复制，并按相同目录契约和安全语法校验。
+      def initialize(overrides: {})
+        supplied = Support.object(overrides, name: "template overrides")
+        raise Error, "unknown template override" unless (supplied.keys - Catalog.template_keys).empty?
+
+        @sources = Catalog.template_keys.to_h do |key|
+          source = supplied.fetch(key) { File.read(File.join(ROOT, key), encoding: Encoding::UTF_8) }
+          TemplateManager.validate!(source, variables: Catalog.variables_for_template(key))
+          [key, source.dup.freeze]
+        end.freeze
+        freeze
+      end
+
+      def fetch(key)
+        @sources.fetch(key.to_s) { raise Error, "unknown configuration template" }
+      end
+
+      def metadata(key)
+        source = fetch(key)
+        Values.copy({ key: key.to_s, sha256: Digest::SHA256.hexdigest(source), bytes: source.bytesize,
+          variables: Catalog.variables_for_template(key) })
+      end
+
+      def inspect = "#<#{self.class.name} count=#{@sources.size}>"
+    end
+  end
+end