vxlan 0.2.1 → 0.2.3

data/lib/vxlan/cisco_nxos/syntax/routing.rb

@@ -5,18 +5,28 @@ module Vxlan
     module Syntax
       # 路由作用域保留邻居、模板、VRF 与地址族的归属。
       module Routing
+        BGP_LEAF = /\A(?:no )?(?:remote-as|inherit peer|update-source|route-map|next-hop-self|route-reflector-client|advertise-pip|advertise l2vpn evpn|send-community|retain route-target)\b/
+        private_constant :BGP_LEAF
+
         private
 
         # 解析支持的路由作用域及协议关系。
-        def routing(block, protocol, context = :process)
+        def routing(block, protocol, context = :process, family: nil, parent: nil)
           values = { vrfs: {}, neighbors: {}, templates: {}, address_families: {}, redistribute: [] }
           analyze_children(block) do |child|
+            next issue(child) if protocol != :bgp && BGP_LEAF.match?(child.text)
+            next issue(child) unless routing_leaf?(child.text, protocol, context, family, parent)
+
             case child.text
             when /\Avrf (\S+)\z/ then routing_scope(values, :vrfs, $1, child, protocol, context)
             when /\Atemplate peer (\S+)\z/ then routing_scope(values, :templates, $1, child, protocol, context)
             when /\Aneighbor (\S+)\z/ then routing_scope(values, :neighbors, $1, child, protocol, context)
             when /\Aaddress-family (.+)\z/ then routing_scope(values, :address_families, $1, child, protocol, context)
-            when /\Arouter-id (\S+)\z/ then assign(values, :router_id, address($1), child)
+            when /\Arouter-id (\S+)\z/
+              router_id = ip_address($1)
+              raise ArgumentError unless IPAddr.new(router_id).ipv4?
+
+              assign(values, :router_id, router_id, child)
             when /\Aremote-as (\S+)\z/
               value = $1
               integer(value, 1..4_294_967_295) unless %w[internal external].include?(value)
@@ -42,9 +52,12 @@ module Vxlan
               assign(values, :extended_community, enabled, child) if kind
             when /\Anetwork (\S+)(?: route-map (\S+))?\z/
               subnet, route_map = $1, $2
-              raise ArgumentError unless protocol == :bgp
+              unless protocol == :bgp && context == :address_families && %i[process vrfs].include?(parent) &&
+                  /\Aipv[46] (?:unicast|multicast)\z/.match?(family)
+                next issue(child)
+              end
 
-              (values[:networks] ||= []) << { prefix: network_prefix(subnet), route_map: route_map }.compact
+              (values[:networks] ||= []) << { prefix: network_prefix(subnet, family: family.split.first), route_map: route_map }.compact
             when /\Aredistribute (\S+)(?: (?!route-map\b)(\S+))?(?: route-map (\S+))?\z/
               values[:redistribute] << { protocol: $1, process: $2, route_map: $3 }.compact
             when /\Aretain route-target (all|route-map \S+)\z/ then assign(values, :retain_route_target, $1, child)
@@ -56,18 +69,44 @@ module Vxlan
           values
         end
 
+        # 已建模叶子必须位于其使用方作用域，不能只因文字可解析就接受事实。
+        def routing_leaf?(text, protocol, context, family, parent)
+          process_family = context == :address_families && %i[process vrfs].include?(parent)
+          case text
+          when /\A(?:remote-as|inherit peer|update-source)\b/
+            protocol == :bgp && %i[neighbors templates].include?(context)
+          when /\Aroute-map\b/
+            protocol == :bgp && context == :address_families && %i[neighbors templates].include?(parent)
+          when /\Aredistribute\b/
+            if protocol == :ospf
+              %i[process vrfs].include?(context)
+            else
+              process_family && /\Aipv[46] (?:unicast|multicast)\z/.match?(family)
+            end
+          when /\Aretain route-target\b/
+            protocol == :bgp && process_family && family == "l2vpn evpn"
+          when /\Arouter-id\b/
+            %i[process vrfs].include?(context)
+          else true
+          end
+        end
+
         # 只进入当前事实模型可表达的子作用域，阻止任意递归及跨协议误归属。
         def routing_scope(values, kind, name, block, protocol, context)
           supported = case kind
           when :vrfs then context == :process
           when :templates then protocol == :bgp && context == :process
           when :neighbors then protocol == :bgp && %i[process vrfs].include?(context)
-          when :address_families then protocol == :bgp && %i[process vrfs neighbors templates].include?(context)
+          when :address_families
+            protocol == :bgp && %i[process vrfs neighbors templates].include?(context) &&
+              /\A(?:ipv[46] (?:unicast|multicast)|vpnv[46] unicast|l2vpn evpn)\z/.match?(name)
           end
           return issue(block) unless supported
 
           conflicts_before = @configuration_conflict_count
-          store(values[kind], name, block, path: @source_path + [ kind, name ]) { routing(block, protocol, kind) }
+          store_unique_fact(values[kind], name, block, path: @source_path + [ kind, name ]) do
+            routing(block, protocol, kind, family: kind == :address_families ? name : nil, parent: context)
+          end
           # 邻居及模板的子地址族冲突也使继承身份失效；保留同进程其他邻居。
           if protocol == :bgp && %i[neighbors templates].include?(kind) && @configuration_conflict_count > conflicts_before
             exclude_conflicted_scope(values[kind], name, block)

data/lib/vxlan/cisco_nxos/terminal.rb

@@ -8,7 +8,9 @@ module Vxlan
       private_constant :INVALID
 
       # 检查原始正文，避免 strip 或字段解析先吞掉控制字符。
-      def self.invalid_output?(text) = INVALID.match?(text)
+      def self.invalid_output?(text, allow_cr_newlines: false)
+        INVALID.match?(text) || (!allow_cr_newlines && /\r(?!\n)/.match?(text))
+      end
     end
   end
 end

data/lib/vxlan/collector.rb

@@ -34,7 +34,7 @@ module Vxlan
       begin
         connector.open do |session|
           reader = CtxDriver::Reader.new(session: session, clock: @clock)
-          if (code = prepare(reader))
+          if (code = prepare_terminal(reader))
             dimensions.each { |name| observations[name] = failure(name, code) }
             observations[:collection] = failure(:collection, code)
             next
@@ -45,7 +45,7 @@ module Vxlan
               observations[name] = Observation.new(name: name, status: :complete, completed_at: @clock.call,
                 issues: [ { code: :vpc_not_configured } ])
             else
-              observations[name] = read(reader, name, config, profile)
+              observations[name] = collect_observation(reader, name, config, profile)
             end
           end
           session_finished = true
@@ -72,7 +72,7 @@ module Vxlan
     private
 
     # 采集设备回显前，禁用分页并归一化终端宽度。
-    def prepare(reader)
+    def prepare_terminal(reader)
       PREPARATION_COMMANDS.each do |command|
         capture = reader.read(command)
         return capture.failure.fetch(:code) unless capture.success?
@@ -81,7 +81,7 @@ module Vxlan
     end
 
     # 解析失败限定在单条查询内；Reader 负责传输与回执校验。
-    def read(reader, name, configuration, profile)
+    def collect_observation(reader, name, configuration, profile)
       command = profile.command(name)
       capture = reader.read(command)
       metadata = { started_at: capture.started_at, completed_at: capture.completed_at, evidence: capture.evidence }

data/lib/vxlan/configuration_review.rb

@@ -15,6 +15,7 @@ module Vxlan
 
       nve_members_by_vni = @configuration.fetch(:nve).fetch(:members, {})
       vlan_mappings_by_vni = @configuration.fetch(:vlan_vnis).group_by { |_vlan, vni| vni }
+      vrf_vnis = @configuration.fetch(:vrfs).values.filter_map { |settings| settings[:vni] }.to_set
       evpn_vnis = @configuration.fetch(:evpn)
       findings = []
       vlan_mappings_by_vni.each do |vni, entries|
@@ -23,14 +24,24 @@ module Vxlan
         findings << { code: :vlan_vni_without_nve, vni: vni, vlan_ids: entries.map(&:first).sort }
       end
       nve_members_by_vni.each do |vni, settings|
-        next if settings[:associate_vrf]
+        if settings[:associate_vrf]
+          findings << { code: :nve_l3_without_vrf, vni: vni } unless vrf_vnis.include?(vni)
+          next
+        end
 
         findings << { code: :nve_l2_without_vlan, vni: vni } unless vlan_mappings_by_vni.key?(vni)
         if @configuration[:nv_overlay_evpn] && !evpn_vnis.key?(vni)
           findings << { code: :nve_l2_without_evpn, vni: vni }
         end
       end
-      evpn_vnis.each_key { |vni| findings << { code: :evpn_vni_without_nve, vni: vni } unless nve_members_by_vni.key?(vni) }
+      evpn_vnis.each do |vni, settings|
+        member = nve_members_by_vni[vni]
+        if !member
+          findings << { code: :evpn_vni_without_nve, vni: vni }
+        elsif (settings[:type] == "l3") != member[:associate_vrf]
+          findings << { code: :vni_layer_conflict, vni: vni, evpn_type: settings[:type] }
+        end
+      end
       @configuration.fetch(:vrfs).each do |name, settings|
         next unless settings[:vni]
         member = nve_members_by_vni[settings[:vni]]

data/lib/vxlan/prefix_list_references.rb

@@ -14,7 +14,7 @@ module Vxlan
     def call(address_family: "ipv4")
       raise ArgumentError, "Unsupported address family" unless %w[ipv4 ipv6].include?(address_family)
 
-      bindings = route_map_bindings.transform_values(&:uniq)
+      consumers_by_route_map = route_map_consumers.transform_values(&:uniq)
       references = @configuration.fetch(:route_maps).each_with_object({}) do |(name, entries), result|
         entries.sort_by { |entry| entry.fetch(:sequence) }.each do |entry|
           matches = entry.fetch(:prefix_list_matches) do
@@ -22,7 +22,7 @@ module Vxlan
           end
           matches.select { |match| match[:address_family] == address_family }.each do |match|
             route_map_reference = { type: "route_map", name: name, sequence: entry.fetch(:sequence), action: entry.fetch(:action),
-              bindings: bindings.fetch(name, []).dup }
+              bindings: consumers_by_route_map.fetch(name, []).dup }
             route_map_reference[:selector] = match[:selector] unless match[:selector] == "address"
             match.fetch(:names).uniq.each do |prefix_list|
               (result[prefix_list] ||= []) << route_map_reference
@@ -37,7 +37,7 @@ module Vxlan
     private
 
     # 关联关系保留协议、VRF、地址族及对等体，避免共享策略被混用。
-    def route_map_bindings
+    def route_map_consumers
       result = Hash.new { |hash, key| hash[key] = [] }
       bgp = @configuration.fetch(:bgp)
       { "default" => bgp }.merge(bgp.fetch(:vrfs, {})).each do |vrf, settings|

data/lib/vxlan/version.rb

@@ -2,5 +2,5 @@
 
 module Vxlan
   # 公开包版本，供 RubyGems 元数据和运行时调用方共用。
-  VERSION = "0.2.1"
+  VERSION = "0.2.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vxlan
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.3
 platform: ruby
 authors:
 - Gatework contributors
@@ -81,6 +81,7 @@ files:
 - lib/vxlan.rb
 - lib/vxlan/bgp_neighbors.rb
 - lib/vxlan/cisco_nxos/configuration.rb
+- lib/vxlan/cisco_nxos/configuration_state.rb
 - lib/vxlan/cisco_nxos/document.rb
 - lib/vxlan/cisco_nxos/evpn_l2route.rb
 - lib/vxlan/cisco_nxos/parser.rb