vxlan 0.2.1 → 0.2.3

data/lib/vxlan/cisco_nxos/parsers/show_interface_brief.rb

@@ -16,7 +16,7 @@ module Vxlan
         # 解析当前命令的记录，保留无法识别行的诊断。
         def parse_rows(text)
           layout = nil
-          lines(text) do |line, number|
+          each_content_line(text) do |line, number|
             if line.match?(/\A(?:Port\s+VRF\s+Status\s+IP Address(?:\s+Speed\s+MTU)?|(?:Port|Interface)\s+Name\s+Status\s+Vlan\s+Duplex\s+Speed\s+Type|(?:Ethernet|Port-channel)\s+VLAN\s+Type\s+Mode\s+Status\s+Reason\s+Speed\s+(?:Port|Protocol)|Interface\s+Status\s+Description|Interface\s+Secondary VLAN\(Type\)\s+Status Reason|Port\s+Status Reason\s+MTU)\z/i)
               layout = line
               @header = true
@@ -26,7 +26,7 @@ module Vxlan
               words = line.split
               state = words.index { |word| %w[up down connected notconnect disabled admin-down].include?(word.downcase) }
               unless layout && state && INTERFACE.match?(words[0])
-                reject(number)
+                unparsed_records(number)
                 next
               end
               row = { interface: words[0], state: words[state].downcase, detail: words.drop(state + 1).join(" ") }
@@ -37,38 +37,38 @@ module Vxlan
                   row.merge!(vrf: words[1], ip_address: words[3])
                   row.merge!(speed: words[4], mtu: words[5].to_i) if words.size == 6
                 else
-                  reject(number)
+                  unparsed_records(number)
                   next
                 end
               when /\A(?:Ethernet|Port-channel)\s+VLAN/i
                 unless state == 4 && words.size >= 8
-                  reject(number)
+                  unparsed_records(number)
                   next
                 end
                 row.merge!(vlan: words[1], type: words[2], mode: words[3], reason: words[5...-2].join(" "), speed: words[-2])
                 row[layout.start_with?("Ethernet") ? :port_channel : :protocol] = words[-1]
               when /\AInterface\s+Status/i
                 unless state == 1
-                  reject(number)
+                  unparsed_records(number)
                   next
                 end
                 row[:description] = words.drop(2).join(" ")
               when /\AInterface\s+Secondary/i
                 unless state >= 2
-                  reject(number)
+                  unparsed_records(number)
                   next
                 end
                 row.merge!(secondary_vlan: words[1...state].join(" "), reason: words.drop(state + 1).join(" "))
               when /\APort\s+Status Reason/i
                 unless state == 1 && words.size >= 4 && words.last.match?(/\A\d+\z/)
-                  reject(number)
+                  unparsed_records(number)
                   next
                 end
                 row.merge!(reason: words[2...-1].join(" "), mtu: words.last.to_i)
               else
                 match = /\A\S+\s+(.*?)\s+(connected|notconnect|disabled|admin-down|up|down)\s+(\d+|routed|trunk|unassigned|--)\s+(full|half|a-full|a-half|auto|--)\s+(\S+)\s+(.+)\z/i.match(line)
                 unless match
-                  reject(number)
+                  unparsed_records(number)
                   next
                 end
                 row.merge!(name: match[1], state: match[2].downcase, vlan: match[3], duplex: match[4], speed: match[5], type: match[6],

data/lib/vxlan/cisco_nxos/parsers/show_ip_ospf_neighbors.rb

@@ -19,7 +19,7 @@ module Vxlan
         # 解析命令表格行，保留数量及格式错误行诊断。
         def parse_rows(text)
           scope, totals = {}, []
-          lines(text) do |line, number|
+          each_content_line(text) do |line, number|
             if HEADER.match?(line)
               @header = true
             elsif (match = /\AOSPF Process ID (\S+) VRF (\S+)\z/i.match(line))
@@ -31,15 +31,15 @@ module Vxlan
               row[:priority] = row[:priority].to_i
               unless ip_address?(row[:neighbor_id]) && ip_address?(row[:address]) && (0..255).cover?(row[:priority]) &&
                 row[:state].match?(/\A(?:DOWN|ATTEMPT|INIT|2WAY|EXSTART|EXCHANGE|LOADING|FULL)\/(?:\s*(?:DR|BDR|DROTHER|-))\z/i)
-                reject(number)
+                unparsed_records(number)
                 next
               end
               @rows << row.merge(state: row[:state].downcase.delete(" "))
             else
-              reject(number)
+              unparsed_records(number)
             end
           end
-          totals.each { |count| mismatch(count, @rows.size) }
+          totals.each { |count| count_mismatch(count, @rows.size) }
           @empty = true if @rows.empty? && totals == [ 0 ]
         end
       end

data/lib/vxlan/cisco_nxos/parsers/show_mac_address_table.rb

@@ -13,22 +13,22 @@ module Vxlan
 
         # 解析当前命令的记录，保留无法识别行的诊断。
         def parse_rows(text)
-          lines(text) do |line, number|
+          each_content_line(text) do |line, number|
             if line.match?(/\AVLAN\s+MAC Address\s+Type\s+age\s+Secure\s+NTFY\s+Ports\z/i)
               @header = true
             elsif (match = /\A(?:[*+GOCR~]\s+)?(\d+|-)\s+([\da-f]{4}(?:\.[\da-f]{4}){2})\s+(dynamic|static)\s+(\S+)\s+([TF])\s+([TF])\s+(.+)\z/i.match(line))
               unless match[1] == "-" || (1..4094).cover?(match[1].to_i)
-                reject(number)
+                unparsed_records(number)
                 next
               end
               @rows << { vlan_id: match[1] == "-" ? nil : match[1].to_i, mac: CtxParser::Values.mac_address(match[2]),
                 type: match[3].downcase, age: match[4], secure: match[5].upcase == "T", notify: match[6].upcase == "T", destination: match[7],
                 flags: line[/\A([*+GOCR~])\s+/, 1] }
             elsif !line.match?(/\A(?:Legend:|\* - primary entry, G - Gateway MAC, \(R\) - Routed MAC, O - Overlay MAC|age - seconds since last seen,\+ - primary entry using vPC Peer-Link,|\(T\) - True, \(F\) - False, C - ControlPlane MAC, ~ - vsan,?|\(NA\)- Not Applicable(?: A [–-] ESI Active Path, S [–-] ESI Standby Path)?)\z/i)
-              reject(number)
+              unparsed_records(number)
             end
           end
-          remove_duplicates(@rows, %i[vlan_id mac]) do |row|
+          exclude_ambiguous_records!(@rows, %i[vlan_id mac]) do |row|
             identity = row.values_at(:vlan_id, :mac)
             if row[:flags] == "G" && row[:type] == "static" && row[:destination].match?(/\A(?:sup-eth\d+\(R\)|(Lo\d+)\(R\)(?: \(\1\))?)\z/i)
               identity.concat([ :gateway, row[:destination] ])

data/lib/vxlan/cisco_nxos/parsers/show_nve_peers.rb

@@ -17,13 +17,13 @@ module Vxlan
 
         # 解析命令表格行，保留数量及格式错误行诊断。
         def parse_rows(text)
-          lines(text) do |line, number|
+          each_content_line(text) do |line, number|
             if HEADER.match?(line)
               @header = true
             elsif (match = ROW.match(line)) && ip_address?(match[2])
               @rows << FIELDS.zip(match.captures).to_h.merge(state: match[3].downcase)
             else
-              reject(number)
+              unparsed_records(number)
             end
           end
         end
@@ -31,7 +31,7 @@ module Vxlan
         # 归一化平台值，同时保留未知或不支持的状态。
         def normalize(text)
           output = []
-          super.each_line do |line|
+          super.each_line("\n") do |line|
             tail, previous = line.strip, output.last&.strip
             header = previous && previous.end_with?("Route") && tail == "r-Mac"
             mac = previous && tail.match?(/\A[\da-f]{4}\.[\da-f]{4}\z/i) && previous.match?(/\Anve\d+\s+\d+(?:\.\d+){3}\s+(?:Up|Down)\s+\S+\s+\S+\s+[\da-f]{4}\.\z/i)
@@ -41,7 +41,7 @@ module Vxlan
               output << line
             end
           end
-          output.join
+          output.join("")
         end
       end
     end

data/lib/vxlan/cisco_nxos/parsers/show_nve_vni.rb

@@ -17,19 +17,19 @@ module Vxlan
 
         # 解析命令表格行，保留数量及格式错误行诊断。
         def parse_rows(text)
-          lines(text) do |line, number|
+          each_content_line(text) do |line, number|
             if HEADER.match?(line)
               @header = true
             elsif (match = ROW.match(line))
               row = FIELDS.zip(match.captures).to_h.compact
               row[:vni] = row[:vni].to_i
               unless (1..16_777_215).cover?(row[:vni]) && (!row[:flags] || %w[SA S-ND SU Xconn MS-IR HYB].include?(row[:flags]))
-                reject(number)
+                unparsed_records(number)
                 next
               end
               @rows << row.merge(state: row[:state].downcase, type: row[:type].downcase)
             elsif !line.gsub(/\s+/, " ").match?(/\A(?:Codes: CP - Control Plane DP - Data Plane|UC - Unconfigured SA - Suppress ARP|S-ND - Suppress ND|SU - Suppress Unknown Unicast|Xconn - Crossconnect|MS-IR - Multisite Ingress Replication|HYB - Hybrid IRB mode)\z/)
-              reject(number)
+              unparsed_records(number)
             end
           end
         end

data/lib/vxlan/cisco_nxos/parsers/show_port_channel_summary.rb

@@ -16,7 +16,7 @@ module Vxlan
         def parse_rows(text)
           totals = []
           previous = nil
-          lines(text) do |line, number|
+          each_content_line(text) do |line, number|
             issue_count = @issues.size
             if line.match?(/\AGroup\s+Port-(?:Channel)?\s+Type\s+Protocol\s+Member Ports\z/i)
               @header = true
@@ -25,31 +25,31 @@ module Vxlan
               previous = nil
               next
             elsif (match = /\A(\d+)\s+(Po\d+)\(([^\s()]+)\)\s+(\S+)\s+(\S+)\s*(.*)\z/i.match(line))
-              previous = { group: match[1].to_i, interface: match[2], flags: match[3], type: match[4], protocol: match[5], members: members(match[6]) }
+              previous = { group: match[1].to_i, interface: match[2], flags: match[3], type: match[4], protocol: match[5], members: parse_members(match[6]) }
               @rows << previous
             elsif line.match?(/\A(?:Eth(?:ernet)?\S+\([^)]+\)\s*)+\z/i) && previous
-              previous[:members].concat(members(line))
+              previous[:members].concat(parse_members(line))
             elsif (match = /\ANumber of port-channels\s*:\s*(\d+)\z/i.match(line))
               totals << match[1].to_i
               previous = nil
             elsif !line.match?(/\A(?:Flags:\s+D - Down\s+P - Up in port-channel \(members\)|I - Individual\s+H - Hot-standby \(LACP only\)|s - Suspended\s+r - Module-removed|b - BFD Session Wait|S - Switched\s+R - Routed|U - Up \(port-channel\)|p - Up in delay-lacp mode \(member\)|M - Not in use\. Min-links not met)\z/)
-              reject(number)
+              unparsed_records(number)
               previous = nil
             end
             previous = nil if @issues.size > issue_count
           end
           entries = @rows.flat_map { |row| row[:members] }
-          remove_duplicates(entries, nil) { |member| member[:interface].sub(/\AEth(?:ernet)?/i, "Eth") }
+          exclude_ambiguous_records!(entries, nil) { |member| member[:interface].sub(/\AEth(?:ernet)?/i, "Eth") }
           unambiguous = entries.each_with_object({}.compare_by_identity) { |member, index| index[member] = true }
           @rows.each do |row|
             row[:members].select! { |member| unambiguous.key?(member) }
           end
-          totals.each { |total| mismatch(total, @rows.size) }
+          totals.each { |total| count_mismatch(total, @rows.size) }
           @empty = true if totals == [ 0 ] && @rows.empty?
         end
 
         # 将回显的聚合成员归一化为接口身份及状态标志。
-        def members(text)
+        def parse_members(text)
           return [] if text.empty? || text == "--"
           text.split.filter_map do |word|
             match = /\A(Eth(?:ernet)?[\d\/]+)\(([^\s()]+)\)\z/i.match(word)

data/lib/vxlan/cisco_nxos/parsers/show_running_config.rb

@@ -24,20 +24,23 @@ module Vxlan
 
         # 解析运行配置，不依赖传输或资产清单。
         def parse_output(text, complete:)
-          configuration = CiscoNxos::Configuration.new
-          @issues = configuration.issues
+          configuration_state = CiscoNxos::ConfigurationState.new
+          @issues = configuration_state.issues
           @conflicts = {}
           @policy_sequences = {}
+          @policy_sources = {}.compare_by_identity
           @sources = {}
+          @global_scopes = {}
           @setting_sources = {}.compare_by_identity
           @configuration_conflict_count = 0
           @feature_sources = []
           @disabled_feature_sources = []
-          data = configuration.data
+          data = configuration_state.data
           read_configuration(text, comments: /\A!/, boundaries: /\Aend\z/, document_class: Document).each { |block| parse_block(block, data) }
           @issues.concat(document.issues)
+          finalize_policies(data)
           # 所有声明读取完毕后再关联模板与网段，避免配置先后顺序改变关联结果。
-          configuration.finish
+          configuration_state.finalize_facts
           @feature_sources.each { |block, feature| capture(block, feature, [ :features, data[:features].index(feature) ]) }
           @disabled_feature_sources.each { |block, feature| capture(block, feature, [ :disabled_features, data[:disabled_features].index(feature) ]) }
           data[:config_digest] = Digest::SHA256.hexdigest(@cursor.lines.map(&:raw).reject { |line| line.strip.empty? || line.lstrip.start_with?("!") }.map(&:rstrip).join("\n"))
@@ -59,9 +62,8 @@ module Vxlan
         def parse_setting(block, data)
           case block.text
           when /\Ahostname (\S+)\z/
-            issue(block, :duplicate_hostname) if data[:hostname]
-            data[:hostname] = $1
-            capture(block, data[:hostname], [ :hostname ])
+            name = $1
+            store_global_scope(data, :hostname, block, empty: nil, duplicate_code: :duplicate_hostname) { name }
           when /\Afeature (.+)\z/
             data[:features] << $1
             @feature_sources << [ block, $1 ]
@@ -71,14 +73,13 @@ module Vxlan
           when /\Ainterface breakout module (\d+) port (\d+) map (\d+g-\d+x)\z/
             module_id, port, mapping = integer($1, 1..65_535), integer($2, 1..65_535), $3
             key = "#{module_id}/#{port}"
-            store(data[:breakouts], key, block, path: [ :breakouts, key ]) { { module_id: module_id, port: port, map: mapping } }
+            store_unique_fact(data[:breakouts], key, block, path: [ :breakouts, key ]) { { module_id: module_id, port: port, map: mapping } }
           when /\Ainterface (\S+)\z/
             name = $1.sub(/\Avlan/i, "Vlan")
             if name.match?(/\Anve\d+\z/i)
-              issue(block, :multiple_nve_interfaces) if data[:nve][:interface]
-              data[:nve] = scope(block, [ :nve ]) { nve(block).merge(interface: name) }
+              store_global_scope(data, :nve, block, empty: { members: {} }, duplicate_code: :multiple_nve_interfaces) { nve(block).merge(interface: name) }
             else
-              store(data[:interfaces], name, block, path: [ :interfaces, name ]) { interface(block) }
+              store_unique_fact(data[:interfaces], name, block, path: [ :interfaces, name ]) { interface(block) }
               settings = data[:interfaces][name]
               # VRF 歧义不能等同于默认 VRF；排除此接口，阻止跨接口借址和网段推导。
               if settings && @setting_sources.fetch(settings, {}).key?(:vrf) && !settings.key?(:vrf)
@@ -97,7 +98,7 @@ module Vxlan
 
             mappings = block.children.select { |child| child.text.start_with?("vn-segment") }
             ids.uniq.each do |id|
-              store(data[:vlan_vnis], id, block, path: [ :vlan_vnis, id ]) do
+              store_unique_fact(data[:vlan_vnis], id, block, path: [ :vlan_vnis, id ]) do
                 raise ArgumentError if mappings.size > 1
                 vni = mappings.first && analyze(mappings.first) { integer(mappings.first.text.delete_prefix("vn-segment "), 1..16_777_215) }
                 raise ArgumentError if vni && ids.uniq.size != 1
@@ -105,32 +106,35 @@ module Vxlan
               end
             end
             block.children.each { |child| ignore(child) unless mappings.include?(child) }
-          when /\Avrf context (\S+)\z/ then store(data[:vrfs], $1, block, path: [ :vrfs, $1 ]) { vrf(block) }
+          when /\Avrf context (\S+)\z/ then store_unique_fact(data[:vrfs], $1, block, path: [ :vrfs, $1 ]) { vrf(block) }
           when "evpn"
             analyze_children(block) do |child|
               if (match = /\Avni (\d+) (l[23])\z/i.match(child.text))
                 id = integer(match[1], 1..16_777_215)
-                store(data[:evpn], id, child, path: [ :evpn, id ]) { vrf(child).merge(type: match[2].downcase) }
+                store_unique_fact(data[:evpn], id, child, path: [ :evpn, id ]) { vrf(child, address_families: false).merge(type: match[2].downcase) }
               else
                 issue(child)
               end
             end
           when /\Avpc domain (\d+)\z/
-            issue(block, :duplicate_vpc_domain) if data[:vpc_domain]
-            id = integer($1, 1..1000)
-            data[:vpc_domain] = scope(block, [ :vpc_domain ]) { vpc(block).merge(id: id) }
+            identifier = $1
+            store_global_scope(data, :vpc_domain, block, empty: nil, duplicate_code: :duplicate_vpc_domain) do
+              id = integer(identifier, 1..1000)
+              vpc(block).merge(id: id)
+            end
           when /\Arouter bgp (\d+)\z/
-            asn = integer($1, 1..4_294_967_295)
-            issue(block, :duplicate_bgp_process) if data[:bgp].any?
-            data[:bgp] = scope(block, [ :bgp ]) { routing(block, :bgp).merge(asn: asn) }
-          when /\Arouter ospf (\S+)\z/ then store(data[:ospf], $1, block, path: [ :ospf, $1 ]) { routing(block, :ospf) }
+            identifier = $1
+            store_global_scope(data, :bgp, block, empty: {}, duplicate_code: :duplicate_bgp_process) do
+              asn = integer(identifier, 1..4_294_967_295)
+              routing(block, :bgp).merge(asn: asn)
+            end
+          when /\Arouter ospf (\S+)\z/ then store_unique_fact(data[:ospf], $1, block, path: [ :ospf, $1 ]) { routing(block, :ospf) }
           when /\Aip prefix-list / then prefix_list(block, data[:prefix_lists], family: "ipv4")
           when /\Aipv6 prefix-list / then prefix_list(block, data[:ipv6_prefix_lists], family: "ipv6")
           when /\Aroute-map (\S+) (permit|deny) (\d+)\z/
             name, action, sequence = $1, $2, integer($3, 1..65_535)
             entries = (data[:route_maps][name] ||= [])
-            issue(block, :duplicate_route_map_entry) if register_policy_sequence(:route_maps, name, sequence)
-            entries << scope(block, [ :route_maps, name, entries.size ]) { route_map(block).merge(action: action, sequence: sequence) }
+            policy_entry(:route_maps, name, sequence, entries, block) { route_map(block).merge(action: action, sequence: sequence) }
           when /\Aip access-list (\S+)\z/
             name = $1
             entries = block.children.filter_map do |child|
@@ -145,14 +149,16 @@ module Vxlan
                 end
               end
             end
-            store(data[:acls], name, block, path: [ :acls, name ]) { entries }
+            store_unique_fact(data[:acls], name, block, path: [ :acls, name ]) { entries }
           when /\Aip route /
             data[:static_routes] << scope(block, [ :static_routes, data[:static_routes].size ]) { static_route(block) }
           when "nv overlay evpn", "no nv overlay evpn"
             assign(data, :nv_overlay_evpn, block.text == "nv overlay evpn", block)
             capture(block, data[:nv_overlay_evpn], [ :nv_overlay_evpn ]) if data.key?(:nv_overlay_evpn)
           when /\Afabric forwarding anycast-gateway-mac (\S+)\z/
-            assign(data, :anycast_mac, $1, block)
+            mac = $1
+            CtxParser::Values.mac_address(mac)
+            assign(data, :anycast_mac, mac, block)
             capture(block, data[:anycast_mac], [ :anycast_mac ]) if data.key?(:anycast_mac)
           when /\A(?:interface|vlan|vrf|router|vpc|evpn|feature|ip prefix-list|ipv6 prefix-list|route-map)\b/ then issue(block)
           when /\A(?:%|ERROR:|Invalid command|--More--)/i then issue(block, :invalid_command_output)
@@ -162,7 +168,7 @@ module Vxlan
         end
 
         # 解析 VRF 定义及其 VNI 或 route-target 关联。
-        def vrf(block)
+        def vrf(block, address_families: true)
           values = { route_targets: [], routes: [] }
           analyze_children(block) do |child|
             case child.text
@@ -171,6 +177,8 @@ module Vxlan
             when /\Aroute-target / then values[:route_targets] << route_target(child)
             when /\Aaddress-family (.+)\z/
               family = $1
+              next issue(child) unless address_families && %w[ipv4\ unicast ipv6\ unicast].include?(family)
+
               targets_start = values[:route_targets].size
               exports_start = values.fetch(:exports, []).size
               analyze_children(child) do |setting|
@@ -210,8 +218,8 @@ module Vxlan
           values = { peer_keepalive: {}, virtual_peer_link: {}, peer_gateway: false, peer_switch: false, layer3_peer_router: false }
           analyze_children(block) do |child|
             case child.text
-            when /\Apeer-keepalive (.+)\z/ then assign(values, :peer_keepalive, pairs($1, %w[destination source vrf]), child)
-            when /\Avirtual peer-link (.+)\z/ then assign(values, :virtual_peer_link, pairs($1, %w[destination source dscp]), child)
+            when /\Apeer-keepalive (.+)\z/ then assign(values, :peer_keepalive, parse_keyword_pairs($1, %w[destination source vrf]), child)
+            when /\Avirtual peer-link (.+)\z/ then assign(values, :virtual_peer_link, parse_keyword_pairs($1, %w[destination source dscp]), child)
             when "peer-gateway" then values[:peer_gateway] = true
             when "peer-switch" then values[:peer_switch] = true
             when "layer3 peer-router" then values[:layer3_peer_router] = true
@@ -224,12 +232,12 @@ module Vxlan
         end
 
         # 提取支持的键值配置对。
-        def pairs(text, allowed)
+        def parse_keyword_pairs(text, allowed)
           words = text.split
           raise ArgumentError unless words.size.even? && (words.each_slice(2).map(&:first) - allowed).empty?
           values = words.each_slice(2).to_h.transform_keys(&:to_sym)
           raise ArgumentError unless values.size == words.size / 2
-          %i[source destination].each { |key| values[key] = address(values[key]) if values[key] }
+          %i[source destination].each { |key| values[key] = ip_address(values[key]) if values[key] }
           integer(values[:dscp], 0..63) if values[:dscp]
           values
         end
@@ -238,7 +246,29 @@ module Vxlan
         def static_route(block)
           words = block.text.split
           raise ArgumentError if words.size < 4
-          { prefix: prefix(words[2]), next_hop: words[3], options: words.drop(4).join(" ") }
+          validate_static_next_hop(words.drop(3))
+
+          { prefix: ipv4_prefix(words[2]), next_hop: words[3], options: words.drop(4).join(" ") }
+        end
+
+        # IP route 的下一跳是 IPv4 或出接口；接口分词形式不能误当作地址拒绝。
+        def validate_static_next_hop(words)
+          hop = words.first
+          interface = /\A(?:ethernet\d+(?:\/\d+){1,2}(?:\.\d+)?|port-channel\d+(?:\.\d+)?|vlan\d+|mgmt\d+|null0)\z/i
+          offset = if interface.match?(hop)
+            1
+          elsif /\A(?:ethernet|port-channel|vlan|mgmt|null)\z/i.match?(hop)
+            raise ArgumentError unless words[1] && interface.match?(hop + words[1])
+
+            2
+          else
+            0
+          end
+          hop = words[offset]
+          # 出接口之后可直接跟已有选项；其余词须先作为 IPv4 下一跳校验。
+          return if offset.positive? && (hop.nil? || /\A(?:name|tag|track|vrf|\d+)\z/.match?(hop))
+
+          raise ArgumentError unless IPAddr.new(ip_address(hop)).ipv4?
         end
 
         # 解析十进制整数，并校验声明的边界。
@@ -247,13 +277,13 @@ module Vxlan
           CtxParser::Values.integer(value, min: range.min, max: range.max)
         end
 
-        # 校验接口地址，同时保留网络前缀。
-        def address(value)
+        # 校验并归一化 IPv4 或 IPv6 主机地址，不接受网络前缀。
+        def ip_address(value)
           CtxParser::Values.ip_address(value, allow_zone: true)
         end
 
         # 校验网络前缀，不静默修正错误语法。
-        def prefix(value, preserve_host_bits: false) = CtxParser::Values.ipv4_prefix(value, preserve_host_bits: preserve_host_bits)
+        def ipv4_prefix(value, preserve_host_bits: false) = CtxParser::Values.ipv4_prefix(value, preserve_host_bits: preserve_host_bits)
 
         # 单值配置可重复确认，冲突后移除歧义字段并使两端来源失效。
         def assign(values, key, value, block)
@@ -276,15 +306,22 @@ module Vxlan
           issue(block, :conflicting_configuration_value)
         end
 
-        # 保存已解析配置，同时保留其来源。
-        def store(hash, key, block, path:)
+        # 全局单例共享唯一身份规则，歧义后恢复空形状供下游安全读取。
+        def store_global_scope(data, key, block, empty:, duplicate_code:)
+          store_unique_fact(@global_scopes, key, block, path: [ key ], duplicate_code: duplicate_code) { yield }
+        ensure
+          data[key] = @global_scopes.fetch(key, empty)
+        end
+
+        # 保存唯一身份的事实及来源；重复身份整体排除，后续声明不能恢复。
+        def store_unique_fact(hash, key, block, path:, duplicate_code: :duplicate_identity)
           identity = [ hash.object_id, key ]
           if hash.key?(key) || @conflicts[identity]
             @configuration_conflict_count += 1
             @conflicts[identity] = true
             hash.delete(key)
             @cursor.mark(@sources[identity].index, state: :invalid) if @sources[identity]
-            issue(block, :duplicate_identity)
+            issue(block, duplicate_code)
             return
           end
           @sources[identity] = block

data/lib/vxlan/cisco_nxos/parsers/show_vpc_brief.rb

@@ -14,7 +14,7 @@ module Vxlan
           values, section = { attributes: {}, peer_links: [], members: [] }, nil
           labels = { "vPC domain id" => :domain_id, "Peer status" => :peer_status, "vPC keep-alive status" => :keepalive_status,
             "Configuration consistency status" => :consistency_status, "vPC role" => :role }
-          lines(text) do |line, number|
+          each_content_line(text) do |line, number|
             if line.match?(/\Aid\s+Port\s+Status\s+Active vlans\z/i)
               section = :peer_links
             elsif line.match?(/\Aid\s+Port\s+Status\s+Consistency\s+Reason\s+Active vlans\z/i)
@@ -25,14 +25,14 @@ module Vxlan
               if section == :members
                 member = /\A(\S+)\s+(.+?)\s{2,}([\d, .-]+)\z/.match(match[4])
                 unless member
-                  reject(number)
+                  unparsed_records(number)
                   next
                 end
                 row.merge!(consistency: member[1], reason: member[2], active_vlans_summary: member[3])
               elsif match[4].match?(/\A[\d, .-]+\z/)
-                row[:active_vlans_summary] = rest.join
+                row[:active_vlans_summary] = rest.join("")
               else
-                reject(number)
+                unparsed_records(number)
                 next
               end
               values[section] << row
@@ -46,18 +46,18 @@ module Vxlan
               if key
                 @header = true
                 if values.key?(key) || value.empty? || (key == :domain_id && !(value.match?(/\A\d+\z/) && (1..1000).cover?(value.to_i)))
-                  reject(number)
+                  unparsed_records(number)
                 else
                   values[key] = key == :domain_id ? value.to_i : value
                 end
               elsif label.match?(/\A(?:Per-vlan consistency status|Type-2 consistency status|Number of vPCs configured|Peer Gateway|Dual-active excluded VLANs|Graceful Consistency Check|Auto-recovery status|Delay-restore(?: SVI| Orphan-port)? status|Operational Layer3 Peer-router|Virtual-peerlink mode)\z/) && !value.empty?
-                reject(number) if values[:attributes].key?(label)
+                unparsed_records(number) if values[:attributes].key?(label)
                 values[:attributes][label] = value
               else
-                reject(number)
+                unparsed_records(number)
               end
             elsif !line.match?(/\A(?:vPC Peer-link status|vPC status|Legend:|\(\*\) - local vPC is down, forwarding via vPC peer-link|Please check "show vpc consistency-parameters vpc <vpc-num>" for the|consistency reason of down vpc and for type-2 consistency reasons for|any vpc\.)\z/i)
-              reject(number)
+              unparsed_records(number)
             end
           end
           return unless @header
@@ -66,9 +66,9 @@ module Vxlan
           values.values_at(:peer_links, :members).flatten.each { |row| row[:active_vlans_truncated] = row[:active_vlans_summary].include?("...") }
           count = values[:attributes]["Number of vPCs configured"]
           if count
-            count.match?(/\A\d+\z/) ? mismatch(count.to_i, values[:members].size) : @issues << { code: :invalid_vpc_count }
+            count.match?(/\A\d+\z/) ? count_mismatch(count.to_i, values[:members].size) : @issues << { code: :invalid_vpc_count }
           end
-          %i[peer_links members].each { |key| remove_duplicates(values[key], [ :id ]) }
+          %i[peer_links members].each { |key| exclude_ambiguous_records!(values[key], [ :id ]) }
           @rows << values
         end
       end

data/lib/vxlan/cisco_nxos/syntax/interfaces.rb

@@ -12,7 +12,7 @@ module Vxlan
           values = { addresses: [], acl_bindings: {}, anycast: false }
           analyze_children(block) do |child|
             case child.text
-            when /\Aip address (\S+)(?: secondary)?\z/ then values[:addresses] << prefix($1, preserve_host_bits: true)
+            when /\Aip address (\S+)(?: secondary)?\z/ then values[:addresses] << ipv4_prefix($1, preserve_host_bits: true)
             when /\Aip unnumbered (loopback\d+)\z/i then assign(values, :unnumbered_interface, $1, child)
             when /\Avrf member (\S+)\z/ then assign(values, :vrf, $1, child)
             when /\Aip router ospf (\S+) area (\S+)\z/ then assign(values, :ospf, "#{$1} area #{$2}", child)
@@ -48,7 +48,7 @@ module Vxlan
               analyze_children(child) { |setting| nve_member(setting, member) }
               raise ArgumentError if member[:replication] == "bgp" && member[:multicast_group]
 
-              store(values[:members], id, child, path: @source_path + [ :members, id ]) { member }
+              store_unique_fact(values[:members], id, child, path: @source_path + [ :members, id ]) { member }
             when /\Adescription (.+)\z/ then assign(values, :description, $1, child)
             when /\Aglobal mcast-group (\S+)\z/ then assign(values, :multicast_group, multicast_address($1), child)
             when /\Asource-interface (\S+)\z/ then assign(values, :source_interface, $1, child)
@@ -80,7 +80,7 @@ module Vxlan
 
         # 校验 VXLAN 复制使用的组播地址。
         def multicast_address(value)
-          group = address(value)
+          group = ip_address(value)
           raise ArgumentError unless IPAddr.new("224.0.0.0/4").include?(group)
 
           group

data/lib/vxlan/cisco_nxos/syntax/policies.rb

@@ -12,24 +12,46 @@ module Vxlan
           return ignore(block) if /\A(?:ip|ipv6) prefix-list \S+ description .+\z/.match?(block.text)
           match = /\A(?:ip|ipv6) prefix-list (\S+) seq (\d+) (permit|deny) (\S+)(?: ge (\d+))?(?: le (\d+))?\z/.match(block.text)
           raise ArgumentError unless match
-          subnet = network_prefix(match[4], family: family)
-          length, width = IPAddr.new(subnet).prefix, family == "ipv6" ? 128 : 32
-          ge, le = match[5]&.to_i, match[6]&.to_i
-          raise ArgumentError if (ge && !(length..width).cover?(ge)) || (le && !((ge || length)..width).cover?(le))
-          entries = (lists[match[1]] ||= [])
           sequence = integer(match[2], 1..4_294_967_295)
           collection = family == "ipv6" ? :ipv6_prefix_lists : :prefix_lists
-          raise ArgumentError if register_policy_sequence(collection, match[1], sequence)
-          entries << { sequence: sequence, action: match[3], prefix: subnet, ge: ge, le: le }
-          capture(block, entries.last, [ collection, match[1], entries.size - 1 ])
+          entries = (lists[match[1]] ||= [])
+          policy_entry(collection, match[1], sequence, entries, block) do
+            subnet = network_prefix(match[4], family: family)
+            length, width = IPAddr.new(subnet).prefix, family == "ipv6" ? 128 : 32
+            ge, le = match[5]&.to_i, match[6]&.to_i
+            raise ArgumentError if (ge && !(length..width).cover?(ge)) || (le && !((ge || length)..width).cover?(le))
+
+            { sequence: sequence, action: match[3], prefix: subnet, ge: ge, le: le }
+          end
         end
 
-        # 单次解析用索引识别重复序号，避免长策略逐条扫描已有条目。
-        def register_policy_sequence(collection, name, sequence)
+        # 用固定槽位排除冲突序号，避免反复扫描或移动整个策略数组。
+        def policy_entry(collection, name, sequence, entries, block)
           key = [ collection, name, sequence ]
-          duplicate = @policy_sequences.key?(key)
-          @policy_sequences[key] = true
-          duplicate
+          if (previous = @policy_sequences[key])
+            entries[previous.fetch(:index)] = nil
+            @cursor.mark(previous.fetch(:block).index, state: :invalid)
+            code = collection == :route_maps ? :duplicate_route_map_entry : :invalid_configuration_value
+            return issue(block, code)
+          end
+          @policy_sequences[key] = { index: entries.size, block: block }
+          entries << nil
+          entry = yield
+          entries[-1] = entry
+          @policy_sources[entry] = block
+          entry
+        end
+
+        # 冲突处理完毕后按最终索引捕获来源，路径与公开结果保持一致。
+        def finalize_policies(data)
+          %i[prefix_lists ipv6_prefix_lists route_maps].each do |collection|
+            data.fetch(collection).each do |name, entries|
+              entries.compact!
+              entries.each_with_index do |entry, index|
+                capture(@policy_sources.fetch(entry), entry, [ collection, name, index ])
+              end
+            end
+          end
         end
 
         # 解析有序 route-map 条目及策略引用。