vxlan 0.2.1 → 0.2.2

data/lib/vxlan/cisco_nxos/parsers/show_mac_address_table.rb

@@ -13,22 +13,22 @@ module Vxlan
 
         # 解析当前命令的记录，保留无法识别行的诊断。
         def parse_rows(text)
-          lines(text) do |line, number|
+          each_content_line(text) do |line, number|
             if line.match?(/\AVLAN\s+MAC Address\s+Type\s+age\s+Secure\s+NTFY\s+Ports\z/i)
               @header = true
             elsif (match = /\A(?:[*+GOCR~]\s+)?(\d+|-)\s+([\da-f]{4}(?:\.[\da-f]{4}){2})\s+(dynamic|static)\s+(\S+)\s+([TF])\s+([TF])\s+(.+)\z/i.match(line))
               unless match[1] == "-" || (1..4094).cover?(match[1].to_i)
-                reject(number)
+                unparsed_records(number)
                 next
               end
               @rows << { vlan_id: match[1] == "-" ? nil : match[1].to_i, mac: CtxParser::Values.mac_address(match[2]),
                 type: match[3].downcase, age: match[4], secure: match[5].upcase == "T", notify: match[6].upcase == "T", destination: match[7],
                 flags: line[/\A([*+GOCR~])\s+/, 1] }
             elsif !line.match?(/\A(?:Legend:|\* - primary entry, G - Gateway MAC, \(R\) - Routed MAC, O - Overlay MAC|age - seconds since last seen,\+ - primary entry using vPC Peer-Link,|\(T\) - True, \(F\) - False, C - ControlPlane MAC, ~ - vsan,?|\(NA\)- Not Applicable(?: A [–-] ESI Active Path, S [–-] ESI Standby Path)?)\z/i)
-              reject(number)
+              unparsed_records(number)
             end
           end
-          remove_duplicates(@rows, %i[vlan_id mac]) do |row|
+          exclude_ambiguous_records!(@rows, %i[vlan_id mac]) do |row|
             identity = row.values_at(:vlan_id, :mac)
             if row[:flags] == "G" && row[:type] == "static" && row[:destination].match?(/\A(?:sup-eth\d+\(R\)|(Lo\d+)\(R\)(?: \(\1\))?)\z/i)
               identity.concat([ :gateway, row[:destination] ])

data/lib/vxlan/cisco_nxos/parsers/show_nve_peers.rb

@@ -17,13 +17,13 @@ module Vxlan
 
         # 解析命令表格行，保留数量及格式错误行诊断。
         def parse_rows(text)
-          lines(text) do |line, number|
+          each_content_line(text) do |line, number|
             if HEADER.match?(line)
               @header = true
             elsif (match = ROW.match(line)) && ip_address?(match[2])
               @rows << FIELDS.zip(match.captures).to_h.merge(state: match[3].downcase)
             else
-              reject(number)
+              unparsed_records(number)
             end
           end
         end

data/lib/vxlan/cisco_nxos/parsers/show_nve_vni.rb

@@ -17,19 +17,19 @@ module Vxlan
 
         # 解析命令表格行，保留数量及格式错误行诊断。
         def parse_rows(text)
-          lines(text) do |line, number|
+          each_content_line(text) do |line, number|
             if HEADER.match?(line)
               @header = true
             elsif (match = ROW.match(line))
               row = FIELDS.zip(match.captures).to_h.compact
               row[:vni] = row[:vni].to_i
               unless (1..16_777_215).cover?(row[:vni]) && (!row[:flags] || %w[SA S-ND SU Xconn MS-IR HYB].include?(row[:flags]))
-                reject(number)
+                unparsed_records(number)
                 next
               end
               @rows << row.merge(state: row[:state].downcase, type: row[:type].downcase)
             elsif !line.gsub(/\s+/, " ").match?(/\A(?:Codes: CP - Control Plane DP - Data Plane|UC - Unconfigured SA - Suppress ARP|S-ND - Suppress ND|SU - Suppress Unknown Unicast|Xconn - Crossconnect|MS-IR - Multisite Ingress Replication|HYB - Hybrid IRB mode)\z/)
-              reject(number)
+              unparsed_records(number)
             end
           end
         end

data/lib/vxlan/cisco_nxos/parsers/show_port_channel_summary.rb

@@ -16,7 +16,7 @@ module Vxlan
         def parse_rows(text)
           totals = []
           previous = nil
-          lines(text) do |line, number|
+          each_content_line(text) do |line, number|
             issue_count = @issues.size
             if line.match?(/\AGroup\s+Port-(?:Channel)?\s+Type\s+Protocol\s+Member Ports\z/i)
               @header = true
@@ -25,31 +25,31 @@ module Vxlan
               previous = nil
               next
             elsif (match = /\A(\d+)\s+(Po\d+)\(([^\s()]+)\)\s+(\S+)\s+(\S+)\s*(.*)\z/i.match(line))
-              previous = { group: match[1].to_i, interface: match[2], flags: match[3], type: match[4], protocol: match[5], members: members(match[6]) }
+              previous = { group: match[1].to_i, interface: match[2], flags: match[3], type: match[4], protocol: match[5], members: parse_members(match[6]) }
               @rows << previous
             elsif line.match?(/\A(?:Eth(?:ernet)?\S+\([^)]+\)\s*)+\z/i) && previous
-              previous[:members].concat(members(line))
+              previous[:members].concat(parse_members(line))
             elsif (match = /\ANumber of port-channels\s*:\s*(\d+)\z/i.match(line))
               totals << match[1].to_i
               previous = nil
             elsif !line.match?(/\A(?:Flags:\s+D - Down\s+P - Up in port-channel \(members\)|I - Individual\s+H - Hot-standby \(LACP only\)|s - Suspended\s+r - Module-removed|b - BFD Session Wait|S - Switched\s+R - Routed|U - Up \(port-channel\)|p - Up in delay-lacp mode \(member\)|M - Not in use\. Min-links not met)\z/)
-              reject(number)
+              unparsed_records(number)
               previous = nil
             end
             previous = nil if @issues.size > issue_count
           end
           entries = @rows.flat_map { |row| row[:members] }
-          remove_duplicates(entries, nil) { |member| member[:interface].sub(/\AEth(?:ernet)?/i, "Eth") }
+          exclude_ambiguous_records!(entries, nil) { |member| member[:interface].sub(/\AEth(?:ernet)?/i, "Eth") }
           unambiguous = entries.each_with_object({}.compare_by_identity) { |member, index| index[member] = true }
           @rows.each do |row|
             row[:members].select! { |member| unambiguous.key?(member) }
           end
-          totals.each { |total| mismatch(total, @rows.size) }
+          totals.each { |total| count_mismatch(total, @rows.size) }
           @empty = true if totals == [ 0 ] && @rows.empty?
         end
 
         # 将回显的聚合成员归一化为接口身份及状态标志。
-        def members(text)
+        def parse_members(text)
           return [] if text.empty? || text == "--"
           text.split.filter_map do |word|
             match = /\A(Eth(?:ernet)?[\d\/]+)\(([^\s()]+)\)\z/i.match(word)

data/lib/vxlan/cisco_nxos/parsers/show_running_config.rb

@@ -24,20 +24,23 @@ module Vxlan
 
         # 解析运行配置，不依赖传输或资产清单。
         def parse_output(text, complete:)
-          configuration = CiscoNxos::Configuration.new
-          @issues = configuration.issues
+          configuration_state = CiscoNxos::ConfigurationState.new
+          @issues = configuration_state.issues
           @conflicts = {}
           @policy_sequences = {}
+          @policy_sources = {}.compare_by_identity
           @sources = {}
+          @global_scopes = {}
           @setting_sources = {}.compare_by_identity
           @configuration_conflict_count = 0
           @feature_sources = []
           @disabled_feature_sources = []
-          data = configuration.data
+          data = configuration_state.data
           read_configuration(text, comments: /\A!/, boundaries: /\Aend\z/, document_class: Document).each { |block| parse_block(block, data) }
           @issues.concat(document.issues)
+          finalize_policies(data)
           # 所有声明读取完毕后再关联模板与网段，避免配置先后顺序改变关联结果。
-          configuration.finish
+          configuration_state.finalize_facts
           @feature_sources.each { |block, feature| capture(block, feature, [ :features, data[:features].index(feature) ]) }
           @disabled_feature_sources.each { |block, feature| capture(block, feature, [ :disabled_features, data[:disabled_features].index(feature) ]) }
           data[:config_digest] = Digest::SHA256.hexdigest(@cursor.lines.map(&:raw).reject { |line| line.strip.empty? || line.lstrip.start_with?("!") }.map(&:rstrip).join("\n"))
@@ -59,9 +62,8 @@ module Vxlan
         def parse_setting(block, data)
           case block.text
           when /\Ahostname (\S+)\z/
-            issue(block, :duplicate_hostname) if data[:hostname]
-            data[:hostname] = $1
-            capture(block, data[:hostname], [ :hostname ])
+            name = $1
+            store_global_scope(data, :hostname, block, empty: nil, duplicate_code: :duplicate_hostname) { name }
           when /\Afeature (.+)\z/
             data[:features] << $1
             @feature_sources << [ block, $1 ]
@@ -71,14 +73,13 @@ module Vxlan
           when /\Ainterface breakout module (\d+) port (\d+) map (\d+g-\d+x)\z/
             module_id, port, mapping = integer($1, 1..65_535), integer($2, 1..65_535), $3
             key = "#{module_id}/#{port}"
-            store(data[:breakouts], key, block, path: [ :breakouts, key ]) { { module_id: module_id, port: port, map: mapping } }
+            store_unique_fact(data[:breakouts], key, block, path: [ :breakouts, key ]) { { module_id: module_id, port: port, map: mapping } }
           when /\Ainterface (\S+)\z/
             name = $1.sub(/\Avlan/i, "Vlan")
             if name.match?(/\Anve\d+\z/i)
-              issue(block, :multiple_nve_interfaces) if data[:nve][:interface]
-              data[:nve] = scope(block, [ :nve ]) { nve(block).merge(interface: name) }
+              store_global_scope(data, :nve, block, empty: { members: {} }, duplicate_code: :multiple_nve_interfaces) { nve(block).merge(interface: name) }
             else
-              store(data[:interfaces], name, block, path: [ :interfaces, name ]) { interface(block) }
+              store_unique_fact(data[:interfaces], name, block, path: [ :interfaces, name ]) { interface(block) }
               settings = data[:interfaces][name]
               # VRF 歧义不能等同于默认 VRF；排除此接口，阻止跨接口借址和网段推导。
               if settings && @setting_sources.fetch(settings, {}).key?(:vrf) && !settings.key?(:vrf)
@@ -97,7 +98,7 @@ module Vxlan
 
             mappings = block.children.select { |child| child.text.start_with?("vn-segment") }
             ids.uniq.each do |id|
-              store(data[:vlan_vnis], id, block, path: [ :vlan_vnis, id ]) do
+              store_unique_fact(data[:vlan_vnis], id, block, path: [ :vlan_vnis, id ]) do
                 raise ArgumentError if mappings.size > 1
                 vni = mappings.first && analyze(mappings.first) { integer(mappings.first.text.delete_prefix("vn-segment "), 1..16_777_215) }
                 raise ArgumentError if vni && ids.uniq.size != 1
@@ -105,32 +106,35 @@ module Vxlan
               end
             end
             block.children.each { |child| ignore(child) unless mappings.include?(child) }
-          when /\Avrf context (\S+)\z/ then store(data[:vrfs], $1, block, path: [ :vrfs, $1 ]) { vrf(block) }
+          when /\Avrf context (\S+)\z/ then store_unique_fact(data[:vrfs], $1, block, path: [ :vrfs, $1 ]) { vrf(block) }
           when "evpn"
             analyze_children(block) do |child|
               if (match = /\Avni (\d+) (l[23])\z/i.match(child.text))
                 id = integer(match[1], 1..16_777_215)
-                store(data[:evpn], id, child, path: [ :evpn, id ]) { vrf(child).merge(type: match[2].downcase) }
+                store_unique_fact(data[:evpn], id, child, path: [ :evpn, id ]) { vrf(child).merge(type: match[2].downcase) }
               else
                 issue(child)
               end
             end
           when /\Avpc domain (\d+)\z/
-            issue(block, :duplicate_vpc_domain) if data[:vpc_domain]
-            id = integer($1, 1..1000)
-            data[:vpc_domain] = scope(block, [ :vpc_domain ]) { vpc(block).merge(id: id) }
+            identifier = $1
+            store_global_scope(data, :vpc_domain, block, empty: nil, duplicate_code: :duplicate_vpc_domain) do
+              id = integer(identifier, 1..1000)
+              vpc(block).merge(id: id)
+            end
           when /\Arouter bgp (\d+)\z/
-            asn = integer($1, 1..4_294_967_295)
-            issue(block, :duplicate_bgp_process) if data[:bgp].any?
-            data[:bgp] = scope(block, [ :bgp ]) { routing(block, :bgp).merge(asn: asn) }
-          when /\Arouter ospf (\S+)\z/ then store(data[:ospf], $1, block, path: [ :ospf, $1 ]) { routing(block, :ospf) }
+            identifier = $1
+            store_global_scope(data, :bgp, block, empty: {}, duplicate_code: :duplicate_bgp_process) do
+              asn = integer(identifier, 1..4_294_967_295)
+              routing(block, :bgp).merge(asn: asn)
+            end
+          when /\Arouter ospf (\S+)\z/ then store_unique_fact(data[:ospf], $1, block, path: [ :ospf, $1 ]) { routing(block, :ospf) }
           when /\Aip prefix-list / then prefix_list(block, data[:prefix_lists], family: "ipv4")
           when /\Aipv6 prefix-list / then prefix_list(block, data[:ipv6_prefix_lists], family: "ipv6")
           when /\Aroute-map (\S+) (permit|deny) (\d+)\z/
             name, action, sequence = $1, $2, integer($3, 1..65_535)
             entries = (data[:route_maps][name] ||= [])
-            issue(block, :duplicate_route_map_entry) if register_policy_sequence(:route_maps, name, sequence)
-            entries << scope(block, [ :route_maps, name, entries.size ]) { route_map(block).merge(action: action, sequence: sequence) }
+            policy_entry(:route_maps, name, sequence, entries, block) { route_map(block).merge(action: action, sequence: sequence) }
           when /\Aip access-list (\S+)\z/
             name = $1
             entries = block.children.filter_map do |child|
@@ -145,7 +149,7 @@ module Vxlan
                 end
               end
             end
-            store(data[:acls], name, block, path: [ :acls, name ]) { entries }
+            store_unique_fact(data[:acls], name, block, path: [ :acls, name ]) { entries }
           when /\Aip route /
             data[:static_routes] << scope(block, [ :static_routes, data[:static_routes].size ]) { static_route(block) }
           when "nv overlay evpn", "no nv overlay evpn"
@@ -210,8 +214,8 @@ module Vxlan
           values = { peer_keepalive: {}, virtual_peer_link: {}, peer_gateway: false, peer_switch: false, layer3_peer_router: false }
           analyze_children(block) do |child|
             case child.text
-            when /\Apeer-keepalive (.+)\z/ then assign(values, :peer_keepalive, pairs($1, %w[destination source vrf]), child)
-            when /\Avirtual peer-link (.+)\z/ then assign(values, :virtual_peer_link, pairs($1, %w[destination source dscp]), child)
+            when /\Apeer-keepalive (.+)\z/ then assign(values, :peer_keepalive, parse_keyword_pairs($1, %w[destination source vrf]), child)
+            when /\Avirtual peer-link (.+)\z/ then assign(values, :virtual_peer_link, parse_keyword_pairs($1, %w[destination source dscp]), child)
             when "peer-gateway" then values[:peer_gateway] = true
             when "peer-switch" then values[:peer_switch] = true
             when "layer3 peer-router" then values[:layer3_peer_router] = true
@@ -224,12 +228,12 @@ module Vxlan
         end
 
         # 提取支持的键值配置对。
-        def pairs(text, allowed)
+        def parse_keyword_pairs(text, allowed)
           words = text.split
           raise ArgumentError unless words.size.even? && (words.each_slice(2).map(&:first) - allowed).empty?
           values = words.each_slice(2).to_h.transform_keys(&:to_sym)
           raise ArgumentError unless values.size == words.size / 2
-          %i[source destination].each { |key| values[key] = address(values[key]) if values[key] }
+          %i[source destination].each { |key| values[key] = ip_address(values[key]) if values[key] }
           integer(values[:dscp], 0..63) if values[:dscp]
           values
         end
@@ -238,7 +242,7 @@ module Vxlan
         def static_route(block)
           words = block.text.split
           raise ArgumentError if words.size < 4
-          { prefix: prefix(words[2]), next_hop: words[3], options: words.drop(4).join(" ") }
+          { prefix: ipv4_prefix(words[2]), next_hop: words[3], options: words.drop(4).join(" ") }
         end
 
         # 解析十进制整数，并校验声明的边界。
@@ -247,13 +251,13 @@ module Vxlan
           CtxParser::Values.integer(value, min: range.min, max: range.max)
         end
 
-        # 校验接口地址，同时保留网络前缀。
-        def address(value)
+        # 校验并归一化 IPv4 或 IPv6 主机地址，不接受网络前缀。
+        def ip_address(value)
           CtxParser::Values.ip_address(value, allow_zone: true)
         end
 
         # 校验网络前缀，不静默修正错误语法。
-        def prefix(value, preserve_host_bits: false) = CtxParser::Values.ipv4_prefix(value, preserve_host_bits: preserve_host_bits)
+        def ipv4_prefix(value, preserve_host_bits: false) = CtxParser::Values.ipv4_prefix(value, preserve_host_bits: preserve_host_bits)
 
         # 单值配置可重复确认，冲突后移除歧义字段并使两端来源失效。
         def assign(values, key, value, block)
@@ -276,15 +280,22 @@ module Vxlan
           issue(block, :conflicting_configuration_value)
         end
 
-        # 保存已解析配置，同时保留其来源。
-        def store(hash, key, block, path:)
+        # 全局单例共享唯一身份规则，歧义后恢复空形状供下游安全读取。
+        def store_global_scope(data, key, block, empty:, duplicate_code:)
+          store_unique_fact(@global_scopes, key, block, path: [ key ], duplicate_code: duplicate_code) { yield }
+        ensure
+          data[key] = @global_scopes.fetch(key, empty)
+        end
+
+        # 保存唯一身份的事实及来源；重复身份整体排除，后续声明不能恢复。
+        def store_unique_fact(hash, key, block, path:, duplicate_code: :duplicate_identity)
           identity = [ hash.object_id, key ]
           if hash.key?(key) || @conflicts[identity]
             @configuration_conflict_count += 1
             @conflicts[identity] = true
             hash.delete(key)
             @cursor.mark(@sources[identity].index, state: :invalid) if @sources[identity]
-            issue(block, :duplicate_identity)
+            issue(block, duplicate_code)
             return
           end
           @sources[identity] = block

data/lib/vxlan/cisco_nxos/parsers/show_vpc_brief.rb

@@ -14,7 +14,7 @@ module Vxlan
           values, section = { attributes: {}, peer_links: [], members: [] }, nil
           labels = { "vPC domain id" => :domain_id, "Peer status" => :peer_status, "vPC keep-alive status" => :keepalive_status,
             "Configuration consistency status" => :consistency_status, "vPC role" => :role }
-          lines(text) do |line, number|
+          each_content_line(text) do |line, number|
             if line.match?(/\Aid\s+Port\s+Status\s+Active vlans\z/i)
               section = :peer_links
             elsif line.match?(/\Aid\s+Port\s+Status\s+Consistency\s+Reason\s+Active vlans\z/i)
@@ -25,14 +25,14 @@ module Vxlan
               if section == :members
                 member = /\A(\S+)\s+(.+?)\s{2,}([\d, .-]+)\z/.match(match[4])
                 unless member
-                  reject(number)
+                  unparsed_records(number)
                   next
                 end
                 row.merge!(consistency: member[1], reason: member[2], active_vlans_summary: member[3])
               elsif match[4].match?(/\A[\d, .-]+\z/)
                 row[:active_vlans_summary] = rest.join
               else
-                reject(number)
+                unparsed_records(number)
                 next
               end
               values[section] << row
@@ -46,18 +46,18 @@ module Vxlan
               if key
                 @header = true
                 if values.key?(key) || value.empty? || (key == :domain_id && !(value.match?(/\A\d+\z/) && (1..1000).cover?(value.to_i)))
-                  reject(number)
+                  unparsed_records(number)
                 else
                   values[key] = key == :domain_id ? value.to_i : value
                 end
               elsif label.match?(/\A(?:Per-vlan consistency status|Type-2 consistency status|Number of vPCs configured|Peer Gateway|Dual-active excluded VLANs|Graceful Consistency Check|Auto-recovery status|Delay-restore(?: SVI| Orphan-port)? status|Operational Layer3 Peer-router|Virtual-peerlink mode)\z/) && !value.empty?
-                reject(number) if values[:attributes].key?(label)
+                unparsed_records(number) if values[:attributes].key?(label)
                 values[:attributes][label] = value
               else
-                reject(number)
+                unparsed_records(number)
               end
             elsif !line.match?(/\A(?:vPC Peer-link status|vPC status|Legend:|\(\*\) - local vPC is down, forwarding via vPC peer-link|Please check "show vpc consistency-parameters vpc <vpc-num>" for the|consistency reason of down vpc and for type-2 consistency reasons for|any vpc\.)\z/i)
-              reject(number)
+              unparsed_records(number)
             end
           end
           return unless @header
@@ -66,9 +66,9 @@ module Vxlan
           values.values_at(:peer_links, :members).flatten.each { |row| row[:active_vlans_truncated] = row[:active_vlans_summary].include?("...") }
           count = values[:attributes]["Number of vPCs configured"]
           if count
-            count.match?(/\A\d+\z/) ? mismatch(count.to_i, values[:members].size) : @issues << { code: :invalid_vpc_count }
+            count.match?(/\A\d+\z/) ? count_mismatch(count.to_i, values[:members].size) : @issues << { code: :invalid_vpc_count }
           end
-          %i[peer_links members].each { |key| remove_duplicates(values[key], [ :id ]) }
+          %i[peer_links members].each { |key| exclude_ambiguous_records!(values[key], [ :id ]) }
           @rows << values
         end
       end

data/lib/vxlan/cisco_nxos/syntax/interfaces.rb

@@ -12,7 +12,7 @@ module Vxlan
           values = { addresses: [], acl_bindings: {}, anycast: false }
           analyze_children(block) do |child|
             case child.text
-            when /\Aip address (\S+)(?: secondary)?\z/ then values[:addresses] << prefix($1, preserve_host_bits: true)
+            when /\Aip address (\S+)(?: secondary)?\z/ then values[:addresses] << ipv4_prefix($1, preserve_host_bits: true)
             when /\Aip unnumbered (loopback\d+)\z/i then assign(values, :unnumbered_interface, $1, child)
             when /\Avrf member (\S+)\z/ then assign(values, :vrf, $1, child)
             when /\Aip router ospf (\S+) area (\S+)\z/ then assign(values, :ospf, "#{$1} area #{$2}", child)
@@ -48,7 +48,7 @@ module Vxlan
               analyze_children(child) { |setting| nve_member(setting, member) }
               raise ArgumentError if member[:replication] == "bgp" && member[:multicast_group]
 
-              store(values[:members], id, child, path: @source_path + [ :members, id ]) { member }
+              store_unique_fact(values[:members], id, child, path: @source_path + [ :members, id ]) { member }
             when /\Adescription (.+)\z/ then assign(values, :description, $1, child)
             when /\Aglobal mcast-group (\S+)\z/ then assign(values, :multicast_group, multicast_address($1), child)
             when /\Asource-interface (\S+)\z/ then assign(values, :source_interface, $1, child)
@@ -80,7 +80,7 @@ module Vxlan
 
         # 校验 VXLAN 复制使用的组播地址。
         def multicast_address(value)
-          group = address(value)
+          group = ip_address(value)
           raise ArgumentError unless IPAddr.new("224.0.0.0/4").include?(group)
 
           group

data/lib/vxlan/cisco_nxos/syntax/policies.rb

@@ -12,24 +12,46 @@ module Vxlan
           return ignore(block) if /\A(?:ip|ipv6) prefix-list \S+ description .+\z/.match?(block.text)
           match = /\A(?:ip|ipv6) prefix-list (\S+) seq (\d+) (permit|deny) (\S+)(?: ge (\d+))?(?: le (\d+))?\z/.match(block.text)
           raise ArgumentError unless match
-          subnet = network_prefix(match[4], family: family)
-          length, width = IPAddr.new(subnet).prefix, family == "ipv6" ? 128 : 32
-          ge, le = match[5]&.to_i, match[6]&.to_i
-          raise ArgumentError if (ge && !(length..width).cover?(ge)) || (le && !((ge || length)..width).cover?(le))
-          entries = (lists[match[1]] ||= [])
           sequence = integer(match[2], 1..4_294_967_295)
           collection = family == "ipv6" ? :ipv6_prefix_lists : :prefix_lists
-          raise ArgumentError if register_policy_sequence(collection, match[1], sequence)
-          entries << { sequence: sequence, action: match[3], prefix: subnet, ge: ge, le: le }
-          capture(block, entries.last, [ collection, match[1], entries.size - 1 ])
+          entries = (lists[match[1]] ||= [])
+          policy_entry(collection, match[1], sequence, entries, block) do
+            subnet = network_prefix(match[4], family: family)
+            length, width = IPAddr.new(subnet).prefix, family == "ipv6" ? 128 : 32
+            ge, le = match[5]&.to_i, match[6]&.to_i
+            raise ArgumentError if (ge && !(length..width).cover?(ge)) || (le && !((ge || length)..width).cover?(le))
+
+            { sequence: sequence, action: match[3], prefix: subnet, ge: ge, le: le }
+          end
         end
 
-        # 单次解析用索引识别重复序号，避免长策略逐条扫描已有条目。
-        def register_policy_sequence(collection, name, sequence)
+        # 用固定槽位排除冲突序号，避免反复扫描或移动整个策略数组。
+        def policy_entry(collection, name, sequence, entries, block)
           key = [ collection, name, sequence ]
-          duplicate = @policy_sequences.key?(key)
-          @policy_sequences[key] = true
-          duplicate
+          if (previous = @policy_sequences[key])
+            entries[previous.fetch(:index)] = nil
+            @cursor.mark(previous.fetch(:block).index, state: :invalid)
+            code = collection == :route_maps ? :duplicate_route_map_entry : :invalid_configuration_value
+            return issue(block, code)
+          end
+          @policy_sequences[key] = { index: entries.size, block: block }
+          entries << nil
+          entry = yield
+          entries[-1] = entry
+          @policy_sources[entry] = block
+          entry
+        end
+
+        # 冲突处理完毕后按最终索引捕获来源，路径与公开结果保持一致。
+        def finalize_policies(data)
+          %i[prefix_lists ipv6_prefix_lists route_maps].each do |collection|
+            data.fetch(collection).each do |name, entries|
+              entries.compact!
+              entries.each_with_index do |entry, index|
+                capture(@policy_sources.fetch(entry), entry, [ collection, name, index ])
+              end
+            end
+          end
         end
 
         # 解析有序 route-map 条目及策略引用。

data/lib/vxlan/cisco_nxos/syntax/routing.rb

@@ -5,18 +5,28 @@ module Vxlan
     module Syntax
       # 路由作用域保留邻居、模板、VRF 与地址族的归属。
       module Routing
+        BGP_LEAF = /\A(?:no )?(?:remote-as|inherit peer|update-source|route-map|next-hop-self|route-reflector-client|advertise-pip|advertise l2vpn evpn|send-community|retain route-target)\b/
+        private_constant :BGP_LEAF
+
         private
 
         # 解析支持的路由作用域及协议关系。
-        def routing(block, protocol, context = :process)
+        def routing(block, protocol, context = :process, family: nil, parent: nil)
           values = { vrfs: {}, neighbors: {}, templates: {}, address_families: {}, redistribute: [] }
           analyze_children(block) do |child|
+            next issue(child) if protocol != :bgp && BGP_LEAF.match?(child.text)
+            next issue(child) unless routing_leaf?(child.text, protocol, context, family, parent)
+
             case child.text
             when /\Avrf (\S+)\z/ then routing_scope(values, :vrfs, $1, child, protocol, context)
             when /\Atemplate peer (\S+)\z/ then routing_scope(values, :templates, $1, child, protocol, context)
             when /\Aneighbor (\S+)\z/ then routing_scope(values, :neighbors, $1, child, protocol, context)
             when /\Aaddress-family (.+)\z/ then routing_scope(values, :address_families, $1, child, protocol, context)
-            when /\Arouter-id (\S+)\z/ then assign(values, :router_id, address($1), child)
+            when /\Arouter-id (\S+)\z/
+              router_id = ip_address($1)
+              raise ArgumentError unless IPAddr.new(router_id).ipv4?
+
+              assign(values, :router_id, router_id, child)
             when /\Aremote-as (\S+)\z/
               value = $1
               integer(value, 1..4_294_967_295) unless %w[internal external].include?(value)
@@ -42,9 +52,12 @@ module Vxlan
               assign(values, :extended_community, enabled, child) if kind
             when /\Anetwork (\S+)(?: route-map (\S+))?\z/
               subnet, route_map = $1, $2
-              raise ArgumentError unless protocol == :bgp
+              unless protocol == :bgp && context == :address_families && %i[process vrfs].include?(parent) &&
+                  /\Aipv[46] (?:unicast|multicast)\z/.match?(family)
+                next issue(child)
+              end
 
-              (values[:networks] ||= []) << { prefix: network_prefix(subnet), route_map: route_map }.compact
+              (values[:networks] ||= []) << { prefix: network_prefix(subnet, family: family.split.first), route_map: route_map }.compact
             when /\Aredistribute (\S+)(?: (?!route-map\b)(\S+))?(?: route-map (\S+))?\z/
               values[:redistribute] << { protocol: $1, process: $2, route_map: $3 }.compact
             when /\Aretain route-target (all|route-map \S+)\z/ then assign(values, :retain_route_target, $1, child)
@@ -56,18 +69,44 @@ module Vxlan
           values
         end
 
+        # 已建模叶子必须位于其使用方作用域，不能只因文字可解析就接受事实。
+        def routing_leaf?(text, protocol, context, family, parent)
+          process_family = context == :address_families && %i[process vrfs].include?(parent)
+          case text
+          when /\A(?:remote-as|inherit peer|update-source)\b/
+            protocol == :bgp && %i[neighbors templates].include?(context)
+          when /\Aroute-map\b/
+            protocol == :bgp && context == :address_families && %i[neighbors templates].include?(parent)
+          when /\Aredistribute\b/
+            if protocol == :ospf
+              %i[process vrfs].include?(context)
+            else
+              process_family && /\Aipv[46] (?:unicast|multicast)\z/.match?(family)
+            end
+          when /\Aretain route-target\b/
+            protocol == :bgp && process_family && family == "l2vpn evpn"
+          when /\Arouter-id\b/
+            %i[process vrfs].include?(context)
+          else true
+          end
+        end
+
         # 只进入当前事实模型可表达的子作用域，阻止任意递归及跨协议误归属。
         def routing_scope(values, kind, name, block, protocol, context)
           supported = case kind
           when :vrfs then context == :process
           when :templates then protocol == :bgp && context == :process
           when :neighbors then protocol == :bgp && %i[process vrfs].include?(context)
-          when :address_families then protocol == :bgp && %i[process vrfs neighbors templates].include?(context)
+          when :address_families
+            protocol == :bgp && %i[process vrfs neighbors templates].include?(context) &&
+              /\A(?:ipv[46] (?:unicast|multicast)|vpnv[46] unicast|l2vpn evpn)\z/.match?(name)
           end
           return issue(block) unless supported
 
           conflicts_before = @configuration_conflict_count
-          store(values[kind], name, block, path: @source_path + [ kind, name ]) { routing(block, protocol, kind) }
+          store_unique_fact(values[kind], name, block, path: @source_path + [ kind, name ]) do
+            routing(block, protocol, kind, family: kind == :address_families ? name : nil, parent: context)
+          end
           # 邻居及模板的子地址族冲突也使继承身份失效；保留同进程其他邻居。
           if protocol == :bgp && %i[neighbors templates].include?(kind) && @configuration_conflict_count > conflicts_before
             exclude_conflicted_scope(values[kind], name, block)

data/lib/vxlan/cisco_nxos/terminal.rb

@@ -8,7 +8,9 @@ module Vxlan
       private_constant :INVALID
 
       # 检查原始正文，避免 strip 或字段解析先吞掉控制字符。
-      def self.invalid_output?(text) = INVALID.match?(text)
+      def self.invalid_output?(text, allow_cr_newlines: false)
+        INVALID.match?(text) || (!allow_cr_newlines && /\r(?!\n)/.match?(text))
+      end
     end
   end
 end

data/lib/vxlan/collector.rb

@@ -34,7 +34,7 @@ module Vxlan
       begin
         connector.open do |session|
           reader = CtxDriver::Reader.new(session: session, clock: @clock)
-          if (code = prepare(reader))
+          if (code = prepare_terminal(reader))
             dimensions.each { |name| observations[name] = failure(name, code) }
             observations[:collection] = failure(:collection, code)
             next
@@ -45,7 +45,7 @@ module Vxlan
               observations[name] = Observation.new(name: name, status: :complete, completed_at: @clock.call,
                 issues: [ { code: :vpc_not_configured } ])
             else
-              observations[name] = read(reader, name, config, profile)
+              observations[name] = collect_observation(reader, name, config, profile)
             end
           end
           session_finished = true
@@ -72,7 +72,7 @@ module Vxlan
     private
 
     # 采集设备回显前，禁用分页并归一化终端宽度。
-    def prepare(reader)
+    def prepare_terminal(reader)
       PREPARATION_COMMANDS.each do |command|
         capture = reader.read(command)
         return capture.failure.fetch(:code) unless capture.success?
@@ -81,7 +81,7 @@ module Vxlan
     end
 
     # 解析失败限定在单条查询内；Reader 负责传输与回执校验。
-    def read(reader, name, configuration, profile)
+    def collect_observation(reader, name, configuration, profile)
       command = profile.command(name)
       capture = reader.read(command)
       metadata = { started_at: capture.started_at, completed_at: capture.completed_at, evidence: capture.evidence }

data/lib/vxlan/configuration_review.rb

@@ -15,6 +15,7 @@ module Vxlan
 
       nve_members_by_vni = @configuration.fetch(:nve).fetch(:members, {})
       vlan_mappings_by_vni = @configuration.fetch(:vlan_vnis).group_by { |_vlan, vni| vni }
+      vrf_vnis = @configuration.fetch(:vrfs).values.filter_map { |settings| settings[:vni] }.to_set
       evpn_vnis = @configuration.fetch(:evpn)
       findings = []
       vlan_mappings_by_vni.each do |vni, entries|
@@ -23,14 +24,24 @@ module Vxlan
         findings << { code: :vlan_vni_without_nve, vni: vni, vlan_ids: entries.map(&:first).sort }
       end
       nve_members_by_vni.each do |vni, settings|
-        next if settings[:associate_vrf]
+        if settings[:associate_vrf]
+          findings << { code: :nve_l3_without_vrf, vni: vni } unless vrf_vnis.include?(vni)
+          next
+        end
 
         findings << { code: :nve_l2_without_vlan, vni: vni } unless vlan_mappings_by_vni.key?(vni)
         if @configuration[:nv_overlay_evpn] && !evpn_vnis.key?(vni)
           findings << { code: :nve_l2_without_evpn, vni: vni }
         end
       end
-      evpn_vnis.each_key { |vni| findings << { code: :evpn_vni_without_nve, vni: vni } unless nve_members_by_vni.key?(vni) }
+      evpn_vnis.each do |vni, settings|
+        member = nve_members_by_vni[vni]
+        if !member
+          findings << { code: :evpn_vni_without_nve, vni: vni }
+        elsif (settings[:type] == "l3") != member[:associate_vrf]
+          findings << { code: :vni_layer_conflict, vni: vni, evpn_type: settings[:type] }
+        end
+      end
       @configuration.fetch(:vrfs).each do |name, settings|
         next unless settings[:vni]
         member = nve_members_by_vni[settings[:vni]]