vxlan 0.2.3 → 0.3.1

data/lib/vxlan/change_plan.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+require "ipaddr"
+require "ctx_parser/immutable"
+require_relative "acl_policy"
+
+module Vxlan
+  # 一个已校验、不可变的业务增量；命令、适用前提和回读由同一对象负责。
+  class ChangePlan
+    FIELDS = %w[kind vlan vni].freeze
+    EMPTY_ADDRESSES = [].freeze
+    private_constant :EMPTY_ADDRESSES
+    attr_reader :commands, :rollback
+
+    # 类型判别只发生在输入边界，不接受任意脚本或未声明字段。
+    def self.build(change)
+      raise ArgumentError, "增量须为映射" unless change.is_a?(Hash)
+      case change["kind"]
+      when "vlan_vni_add" then VlanVni.new(change)
+      when "svi_gateway_add" then SviGateway.new(change)
+      when "svi_acl" then SviAcl.new(change)
+      else raise ArgumentError, "不支持的增量类型"
+      end
+    end
+
+    # 审查中的未知或冲突仍为待核实建议，不能构造可执行计划。
+    def self.candidate(change, config:)
+      plan = build(change)
+      plan if plan.eligible?(config)
+    rescue ArgumentError
+      nil
+    end
+
+    # 字符串键规范化后计算语义指纹；Hash 顺序不影响结果，数组保留业务顺序。
+    def self.fingerprint(value) = Digest::SHA256.hexdigest(JSON.generate(canonical(value)))
+
+    # 规范化同时提供独立容器，用于屏蔽唯一允许变化的字段。
+    def self.canonical(value)
+      case value
+      when Hash then value.transform_keys(&:to_s).sort.to_h.transform_values { |entry| canonical(entry) }
+      when Array then value.map { |entry| canonical(entry) }
+      else value
+      end
+    end
+
+    # 构造时一次校验和渲染，随后调用者不能改变已确认的参数或命令。
+    def initialize(change)
+      raise ArgumentError, "请使用 ChangePlan.build 构造业务增量" if instance_of?(ChangePlan)
+      unless change.is_a?(Hash) && change.keys.all?(String) && (change.keys - self.class::FIELDS).empty? && change["kind"] == self.class::KIND
+        raise ArgumentError, "增量字段无效"
+      end
+      @change = CtxParser::Immutable.copy(change)
+      validate_parameters!
+      @commands, @rollback = CtxParser::Immutable.copy(render)
+      freeze
+    end
+
+    # 报告边界保持普通数据及原有指纹，不引入对象序列化格式。
+    def to_h = @change
+
+    # 不完整事实不能满足动态前提；输入错误不能变成肯定结果。
+    def eligible?(config)
+      config.is_a?(Hash) && eligible_state?(config) == true
+    rescue ArgumentError, KeyError, TypeError
+      false
+    end
+
+    # 只允许从合格起点到目标状态；其余已建模业务事实必须完整保留。
+    def satisfied?(after, before:)
+      return false unless eligible?(before) && after.is_a?(Hash) && mapped_svi(after)
+      preserved_context(before) == preserved_context(after) && target_state?(after) == true
+    rescue ArgumentError, KeyError, TypeError
+      false
+    end
+
+    private
+
+    # 三种动作均定位已有 L2 业务，VLAN/VNI 不从字符串或名称猜测。
+    def validate_parameters!
+      raise ArgumentError, "VLAN 无效" unless @change["vlan"].is_a?(Integer) && @change["vlan"].between?(1, 4094)
+      raise ArgumentError, "VNI 无效" unless @change["vni"].is_a?(Integer) && @change["vni"].between?(1, 16_777_215)
+    end
+
+    # 网关相关增量必须携带明确租户及单个已验证 IPv4 前缀。
+    def validate_gateway!
+      address = @change["address"]
+      unless @change["vrf"].is_a?(String) && !@change["vrf"].empty? && address.is_a?(String) &&
+          address.match?(/\A\d{1,3}(?:\.\d{1,3}){3}\/\d{1,2}\z/) && IPAddr.new(address).ipv4?
+        raise ArgumentError, "缺少已验证的业务网关"
+      end
+    end
+
+    # 目标接口由已验证 VLAN 唯一定位，不接受自由接口表达式。
+    def interface = "Vlan#{@change['vlan']}"
+
+    # 关联存在且未指向其他业务时才有可变更的 SVI。
+    def mapped_svi(config)
+      config.dig("interfaces", interface) if config.fetch("vlan_vnis", {})[@change["vlan"].to_s] == @change["vni"]
+    end
+
+    # 网关增量不能改租户、Anycast 模式或与本机其他业务网段重叠。
+    def gateway_context?(config)
+      target_interface = interface
+      svi = config.dig("interfaces", target_interface)
+      return false unless svi && svi["anycast"] == true && svi["vrf"] == @change["vrf"]
+      network = IPAddr.new(@change.fetch("address"))
+      config.fetch("interfaces", {}).each do |name, other|
+        next if name == target_interface || other["vrf"] != @change["vrf"]
+        return false if other.fetch("addresses", EMPTY_ADDRESSES).any? do |address|
+          candidate = IPAddr.new(address)
+          network.include?(candidate) || candidate.include?(network)
+        end
+      end
+      true
+    end
+
+    # 元数据与可推导事实不参与漂移比较；每种动作只移除其允许变化的字段。
+    def preserved_context(config)
+      context = ChangePlan.canonical(config).except("config_digest", "review_status", "review_findings", "segments", "unnumbered_addresses")
+      context.fetch("acls", {}).transform_values! { |entries| AclPolicy.rules(entries) }
+      remove_changed_fields(context)
+      context
+    end
+  end
+end
+
+require_relative "change_plan/vlan_vni"
+require_relative "change_plan/svi_gateway"
+require_relative "change_plan/svi_acl"

data/lib/vxlan/cisco_nxos/configuration_state.rb

@@ -11,7 +11,7 @@ module Vxlan
       # 初始化单次配置解析使用的可变 NX-OS 事实容器。
       def initialize
         @data = { hostname: nil, features: [], disabled_features: [], breakouts: {}, interfaces: {}, vlan_vnis: {}, vrfs: {}, nve: { members: {} },
-          evpn: {}, bgp: {}, ospf: {}, vpc_domain: nil, unnumbered_addresses: {}, prefix_lists: {}, ipv6_prefix_lists: {}, route_maps: {}, acls: {}, static_routes: [] }
+          evpn: {}, bgp: {}, ospf: {}, vpc_domain: nil, unnumbered_addresses: {}, prefix_lists: {}, ipv6_prefix_lists: {}, route_maps: {}, acls: {}, address_groups: {}, static_routes: [] }
         @issues = []
       end
 
@@ -27,9 +27,6 @@ module Vxlan
         data
       end
 
-      # 兼容原有解析状态的收尾入口。
-      alias finish finalize_facts
-
       # 展示对象身份与状态，避免泄露原始回显或凭据。
       def inspect = "#<#{self.class} interfaces=#{data[:interfaces].size} issues=#{issues.size}>"
 

data/lib/vxlan/cisco_nxos/evpn_l2route.rb

@@ -24,7 +24,7 @@ module Vxlan
         fields = previous = next_hop_index = nil
         text.each_line("\n").with_index(1) do |source, number|
           line = source.strip
-          next if line.empty? || line.match?(/\A[-=\s]+\z/) || line.match?(/\A(?:Flags\s*-\s*)?(?:\([A-Za-z0-9]+\):[A-Za-z0-9 ,\/-]+\s*)+\z/)
+          next if line.empty? || line.match?(/\A[-=\s]+\z/) || line.match?(/\A(?:(?:NH\s+)?Flags\s*-\s*)?(?:\([A-Za-z0-9]+\):[A-Za-z0-9 ,\/-]+\s*)+\z/)
           if line.match?(/\ATopology\b/i)
             labels = line.gsub(/\s+/, " ").scan(HEADER)
             fields = labels.map { |label| LABELS.fetch(label.downcase) }

data/lib/vxlan/cisco_nxos/parsers/show_bgp_l2vpn_evpn_summary.rb

@@ -10,33 +10,86 @@ module Vxlan
         EMPTY = "(?:BGP )?neighbors"
         IDENTITY = %i[vrf address_family peer_ip].freeze
         BOUNDARY = /^\s*BGP summary information for VRF /
+        SCOPE = /\ABGP summary information for VRF (\S+), address family (.+)\z/
+        ROUTER = /\ABGP router identifier (\S+), local AS number (\S+)\z/
         HEADER = /\ANeighbor\s+V\s+AS\s+MsgRcvd\s+MsgSent\s+TblVer\s+InQ\s+OutQ\s+Up\/Down\s+State\/PfxRcd\z/i
         ROW = /\A([\da-f:.]+)\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)\s+(\S+)\s+(.+)\z/i
         FIELDS = %i[peer_ip version remote_as messages_received messages_sent table_version input_queue output_queue uptime state].freeze
         INTEGERS = %i[version remote_as messages_received messages_sent table_version input_queue output_queue].freeze
+        PREFIX_TYPES = %i[type1 type2 type3 type4 type5 type6 type7 type8 type12].freeze
 
         private
 
+        # 重复物理输出段仍属于同一逻辑 VRF/AF；空表段也必须参与身份冲突检查。
+        def parse_content(text, complete:)
+          super
+          scope, identities, invalid = nil, {}, {}
+          text.each_line("\n") do |line|
+            if (match = SCOPE.match(line.strip))
+              scope = match.captures
+            elsif (match = ROUTER.match(line.strip))
+              identity = router_identity(match)
+              if !identity
+                invalid[scope] ||= :invalid_bgp_identity
+              elsif identities.key?(scope) && identities[scope] != identity
+                invalid[scope] ||= :conflicting_bgp_identity
+              else
+                identities[scope] = identity
+              end
+            end
+          end
+          invalid.each do |key, code|
+            issue = { code: code, vrf: key&.first, address_family: key&.last }
+            @issues << issue unless @issues.include?(issue)
+          end
+          @rows.reject! { |row| invalid.key?(row.values_at(:vrf, :address_family)) }
+        end
+
+        # ASDOT 与 ASPLAIN 用同一数值比较；无效身份不能附着到完整邻居事实。
+        def router_identity(match)
+          router, asn = match.captures
+          return unless ip_address?(router) && IPAddr.new(router).ipv4? && asn.match?(/\A\d+(?:\.\d+)?\z/)
+          parts = asn.split(".").map(&:to_i)
+          return if parts.size == 2 && parts.any? { |part| !part.between?(0, 65_535) }
+          number = parts.size == 2 ? parts.first * 65_536 + parts.last : parts.first
+          [ IPAddr.new(router).to_s, number ] if number.between?(1, 4_294_967_295)
+        end
+
         # 解析命令表格行，保留数量及格式错误行诊断。
         def parse_rows(text)
           scope, prefix_columns, prefix_seen, peers = {}, nil, {}, {}
+          prefix_total = false
           each_content_line(text) do |line, number|
             if HEADER.match?(line)
               @header = true
-            elsif (match = /\ABGP summary information for VRF (\S+), address family (.+)/.match(line))
+            elsif (match = SCOPE.match(line))
               scope = { vrf: match[1], address_family: match[2] }
+              unparsed_records(number) unless scope[:address_family] == "L2VPN EVPN"
               prefix_columns = nil
-            elsif (match = /\ABGP router identifier (\S+), local AS number (\S+)/.match(line))
-              scope.merge!(router_id: match[1].delete_suffix(","), local_as: match[2])
-              unparsed_records(number) unless ip_address?(scope[:router_id]) && scope[:local_as].match?(/\A\d+(?:\.\d+)?\z/)
-            elsif line.match?(/\ANeighbor\s+T\s+AS\s+PfxRcd\s+Type-2\s+Type-3\s+Type-4\s+Type-5(?:\s+Type-12)?\z/)
-              prefix_columns = line.end_with?("Type-12") ? %i[type2 type3 type4 type5 type12] : %i[type2 type3 type4 type5]
+            elsif (match = ROUTER.match(line))
+              scope.merge!(router_id: match[1], local_as: match[2])
+            elsif (match = /\ANeighbor\s+T\s+AS\s+(?:(PfxRcd)\s+)?(Type-[1-9]\d*(?:\s+Type-[1-9]\d*)*)\z/.match(line))
+              prefix_total = !match[1].nil?
+              prefix_columns = match[2].split.map { |column| column.downcase.delete("-").to_sym }
+              if prefix_columns.uniq != prefix_columns || (prefix_columns - PREFIX_TYPES).any?
+                unparsed_records(number)
+                prefix_columns = nil
+              end
             elsif prefix_columns
               words = line.split
-              peer = peers[[ scope[:vrf], scope[:address_family], words[0] ]]
-              if words.size == prefix_columns.size + 4 && %w[I E].include?(words[1]) && words.drop(2).all? { |word| word.match?(/\A\d+\z/) } &&
-                peer && !prefix_seen.key?(peer.object_id) && peer[:remote_as] == words[2].to_i && peer[:prefixes_received] == words[3].to_i
-                peer[:prefixes_by_type] = prefix_columns.zip(words.drop(4).map(&:to_i)).to_h
+              address = CtxParser::Values.ip_address(words[0], allow_zone: true) if ip_address?(words[0])
+              peer = peers[[ scope[:vrf], scope[:address_family], address ]]
+              offset = prefix_total ? 4 : 3
+              if words.size == prefix_columns.size + offset && %w[I E].include?(words[1]) && words.drop(2).all? { |word| word.match?(/\A\d+\z/) } &&
+                peer && peer[:prefixes_received] && !prefix_seen.key?(peer.object_id) && peer[:remote_as] == words[2].to_i &&
+                (!prefix_total || peer[:prefixes_received] == words[3].to_i)
+                counts = words.drop(offset).map(&:to_i)
+                # 路由类型是总前缀的子集；未展示的类型允许存在，已展示之和不能超过总数。
+                if counts.sum > peer[:prefixes_received]
+                  @issues << { code: :inconsistent_prefix_statistics, line: number }
+                else
+                  peer[:prefixes_by_type] = prefix_columns.zip(counts).to_h
+                end
                 prefix_seen[peer.object_id] = true
               else
                 unparsed_records(number)
@@ -44,11 +97,12 @@ module Vxlan
             elsif (match = ROW.match(line))
               row = FIELDS.zip(match.captures).to_h.merge(scope)
               INTEGERS.each { |key| row[key] = row[key].to_i }
-              unless ip_address?(row[:peer_ip]) && row[:version] == 4 && (1..4_294_967_295).cover?(row[:remote_as]) &&
+              unless row[:vrf] && row[:address_family] == "L2VPN EVPN" && ip_address?(row[:peer_ip]) && row[:version] == 4 && (1..4_294_967_295).cover?(row[:remote_as]) &&
                 row[:state].match?(/\A(?:\d+|Idle(?: \(Admin\))?|Active|Connect|OpenSent|OpenConfirm|Shutdown)\z/i)
                 unparsed_records(number)
                 next
               end
+              row[:peer_ip] = CtxParser::Values.ip_address(row[:peer_ip], allow_zone: true)
               row[:state] = row[:state].downcase.tr(" ", "_")
               row[:prefixes_received] = row[:state].match?(/\A\d+\z/) ? row[:state].to_i : nil
               row[:state] = "established" if row[:prefixes_received]

data/lib/vxlan/cisco_nxos/parsers/show_cdp_neighbors_detail.rb

@@ -15,6 +15,7 @@ module Vxlan
         # 解析当前命令的记录，保留无法识别行的诊断。
         def parse_rows(text)
           row, scope, totals = nil, nil, []
+          @field_conflicts = {}.compare_by_identity
           each_content_line(text, separators: true) do |line, number|
             if line.match?(/\A[-=+\s]+\z/)
               scope = nil
@@ -38,7 +39,7 @@ module Vxlan
             end
             case line
             when /\A--More--/i then unparsed_records(number)
-            when /\ASystem Name:\s*(\S.*)\z/i then row[:neighbor_name] = $1
+            when /\ASystem Name:\s*(\S.*)\z/i then assign_field(row, :neighbor_name, $1, number)
             when /\AInterface address\(es\):(?:\s+\d+)?\z/i then scope = :interface_addresses
             when /\AMgmt address\(es\):(?:\s+\d+)?\z/i then scope = :management_addresses
             when /\AIP(?:v[46])? Address:\s*(\S+)\z/i
@@ -49,21 +50,28 @@ module Vxlan
                 unparsed_records(number)
               end
             when /\APlatform:\s*(.+?),\s*Capabilities:\s*(.+)\z/i
-              row.merge!(platform: $1, capabilities: $2)
+              platform, capabilities = $1, $2
+              assign_field(row, :platform, platform, number)
+              assign_field(row, :capabilities, capabilities, number)
               scope = nil
             when /\AInterface:\s*(\S+),\s*Port ID \(outgoing port\):\s*(\S.*)\z/i
-              unparsed_records(number) if row.key?(:interface)
-              row.merge!(interface: $1, neighbor_interface: $2)
+              interface, neighbor_interface = $1, $2
+              assign_field(row, :interface, interface, number)
+              assign_field(row, :neighbor_interface, neighbor_interface, number)
               scope = nil
-            when /\AHoldtime:\s*(\d+) sec\z/i then row[:holdtime] = $1.to_i
+            when /\AHoldtime:\s*(\d+) sec\z/i then assign_field(row, :holdtime, $1.to_i, number)
             when /\AVersion:\z/i
               scope = :version
               row[:version] = ""
             when /\A((?:Local|Remote) Interface MAC):\s*([\da-f]{2}(?::[\da-f]{2}){5})\z/i
-              row[:attributes][$1.downcase.tr(" ", "_").to_sym] = $2.downcase
+              assign_field(row[:attributes], $1.downcase.tr(" ", "_").to_sym, $2.downcase, number)
               scope = nil
-            when /\A(Advertisement Version|Duplex|MTU|Native VLAN|VTP Management Domain|Physical Location|DC_UUID):\s*(.+)\z/i
-              row[:attributes][$1.downcase.tr(" ", "_").to_sym] = $2
+            when /\ADC_UUID:\s*(.*?)\z/i
+              value = $1.empty? ? nil : $1
+              assign_field(row[:attributes], :dc_uuid, value, number)
+              scope = nil
+            when /\A(Advertisement Version|Duplex|MTU|Native VLAN|VTP Management Domain|Physical Location):\s*(.+)\z/i
+              assign_field(row[:attributes], $1.downcase.tr(" ", "_").to_sym, $2, number)
               scope = nil
             else
               scope == :version ? row[:version] = [ row[:version], line ].reject(&:empty?).join("\n") : unparsed_records(number)
@@ -73,6 +81,8 @@ module Vxlan
           totals.each { |total| count_mismatch(total, @rows.size) }
           @empty = true if totals == [ 0 ] && @rows.empty?
           @rows.reject! do |entry|
+            next true if @field_conflicts.fetch(entry, {}).keys.intersect?(%i[neighbor_name interface neighbor_interface])
+
             entry[:neighbor_name] ||= entry[:device_id].sub(/\([^)]*\)\z/, "").split(".").first
             if entry.values_at(:neighbor_name, :interface, :neighbor_interface).any? { |value| value.nil? || value.empty? }
               @issues << { code: :incomplete_cdp_neighbor }
@@ -80,6 +90,20 @@ module Vxlan
             end
           end
         end
+
+        # 单值字段冲突后永久排除，不能被第三次声明或名称回退恢复。
+        def assign_field(values, key, value, number)
+          conflicts = (@field_conflicts[values] ||= {})
+          return if conflicts.key?(key)
+
+          if values.key?(key) && values[key] != value
+            values.delete(key)
+            conflicts[key] = true
+            @issues << { code: :conflicting_cdp_value, line: number, field: key }
+          else
+            values[key] = value
+          end
+        end
       end
     end
   end

data/lib/vxlan/cisco_nxos/parsers/show_mac_address_table.rb

@@ -24,7 +24,7 @@ module Vxlan
               @rows << { vlan_id: match[1] == "-" ? nil : match[1].to_i, mac: CtxParser::Values.mac_address(match[2]),
                 type: match[3].downcase, age: match[4], secure: match[5].upcase == "T", notify: match[6].upcase == "T", destination: match[7],
                 flags: line[/\A([*+GOCR~])\s+/, 1] }
-            elsif !line.match?(/\A(?:Legend:|\* - primary entry, G - Gateway MAC, \(R\) - Routed MAC, O - Overlay MAC|age - seconds since last seen,\+ - primary entry using vPC Peer-Link,|\(T\) - True, \(F\) - False, C - ControlPlane MAC, ~ - vsan,?|\(NA\)- Not Applicable(?: A [–-] ESI Active Path, S [–-] ESI Standby Path)?)\z/i)
+            elsif !line.match?(/\A(?:Legend:|\* - primary entry, G - Gateway MAC, \(R\) - Routed MAC, O - Overlay MAC|age - seconds since last seen,\+ - primary entry using vPC Peer-Link,|\(T\) - True, \(F\) - False, C - ControlPlane MAC, ~ - vsan,?|\(NA\)- Not Applicable(?: A [–-] ESI Active Path, S [–-] ESI Standby Path)?|TL - True Learned, PS - Peer Sync, RO - Re-originate)\z/i)
               unparsed_records(number)
             end
           end

data/lib/vxlan/cisco_nxos/parsers/show_nve_peers.rb

@@ -10,7 +10,7 @@ module Vxlan
         EMPTY = "peers"
         IDENTITY = %i[interface peer_ip].freeze
         HEADER = /\AInterface\s+Peer-IP\s+State\s+LearnType\s+Uptime\s+Router-Mac\z/i
-        ROW = /\A(nve\d+)\s+(\d+(?:\.\d+){3})\s+(Up|Down)\s+(\S+)\s+(\S+)\s+([\da-f]{4}(?:\.[\da-f]{4}){2})\z/i
+        ROW = /\A(nve\d+)\s+(\d+(?:\.\d+){3})\s+(Up|Down)\s+(\S+)\s+(\S+)\s+([\da-f]{4}(?:\.[\da-f]{4}){2}|n\/a)\z/i
         FIELDS = %i[interface peer_ip state learn_type uptime router_mac].freeze
 
         private
@@ -21,7 +21,8 @@ module Vxlan
             if HEADER.match?(line)
               @header = true
             elsif (match = ROW.match(line)) && ip_address?(match[2])
-              @rows << FIELDS.zip(match.captures).to_h.merge(state: match[3].downcase)
+              @rows << FIELDS.zip(match.captures).to_h.merge(state: match[3].downcase,
+                router_mac: match[6].casecmp?("n/a") ? nil : match[6])
             else
               unparsed_records(number)
             end

data/lib/vxlan/cisco_nxos/parsers/show_nve_vni.rb

@@ -23,7 +23,8 @@ module Vxlan
             elsif (match = ROW.match(line))
               row = FIELDS.zip(match.captures).to_h.compact
               row[:vni] = row[:vni].to_i
-              unless (1..16_777_215).cover?(row[:vni]) && (!row[:flags] || %w[SA S-ND SU Xconn MS-IR HYB].include?(row[:flags]))
+              unless (1..16_777_215).cover?(row[:vni]) && multicast_group?(row[:multicast_group]) &&
+                  (!row[:flags] || %w[SA S-ND SU Xconn MS-IR HYB].include?(row[:flags]))
                 unparsed_records(number)
                 next
               end
@@ -33,6 +34,13 @@ module Vxlan
             end
           end
         end
+
+        # 此列也承载单播复制标记；其余值必须是 IPv4 组播主机地址。
+        def multicast_group?(value)
+          return true if %w[UnicastBGP UnicastStatic n/a].include?(value)
+
+          ip_address?(value) && IPAddr.new("224.0.0.0/4").include?(value)
+        end
       end
     end
   end

data/lib/vxlan/cisco_nxos/parsers/show_running_config.rb

@@ -6,8 +6,8 @@ require_relative "../syntax/interfaces"
 require_relative "../syntax/routing"
 require_relative "../syntax/policies"
 require_relative "../document"
-require_relative "../configuration"
-require_relative "../../configuration_review"
+require_relative "../configuration_state"
+require_relative "../../config/review"
 require "ctx_parser/configuration"
 require "ctx_parser/values"
 
@@ -47,7 +47,7 @@ module Vxlan
           @issues << { code: :output_incomplete } unless complete
           status = @issues.empty? ? :complete : :partial
           data[:review_status] = status
-          data[:review_findings] = Vxlan::ConfigurationReview.new(data).call(complete: status == :complete)
+          data[:review_findings] = Vxlan::Config::Review.new(data).call(complete: status == :complete)
           CtxParser::Result.new(status: status, records: [ data ], issues: @issues)
         end
 
@@ -135,6 +135,9 @@ module Vxlan
             name, action, sequence = $1, $2, integer($3, 1..65_535)
             entries = (data[:route_maps][name] ||= [])
             policy_entry(:route_maps, name, sequence, entries, block) { route_map(block).merge(action: action, sequence: sequence) }
+          when /\Aobject-group ip address (\S+)\z/
+            name = $1
+            store_unique_fact(data[:address_groups], name, block, path: [ :address_groups, name ]) { address_group(block) }
           when /\Aip access-list (\S+)\z/
             name = $1
             entries = block.children.filter_map do |child|
@@ -149,7 +152,10 @@ module Vxlan
                 end
               end
             end
-            store_unique_fact(data[:acls], name, block, path: [ :acls, name ]) { entries }
+            store_unique_fact(data[:acls], name, block, path: [ :acls, name ]) do
+              raise ArgumentError unless entries.map { |entry| entry[:sequence] }.uniq.size == entries.size
+              entries
+            end
           when /\Aip route /
             data[:static_routes] << scope(block, [ :static_routes, data[:static_routes].size ]) { static_route(block) }
           when "nv overlay evpn", "no nv overlay evpn"
@@ -337,7 +343,7 @@ module Vxlan
           pending = [ block ]
           until pending.empty?
             entry = pending.pop
-            if /\A(?:no )?(?:hostname|interface|vlan|vrf|router|vpc|evpn|feature|ip address|ip router ospf|ip access-group|ip prefix-list|ipv6 prefix-list|ip access-list|route-map|vn-segment|member vni|route-target|channel-group|fabric forwarding|mtu|ip unnumbered|ip ospf network|switchport mode|switchport access vlan|ip forward|ipv6 address)\b/.match?(entry.text)
+            if /\A(?:no )?(?:hostname|interface|vlan|vrf|router|vpc|evpn|feature|object-group|ip address|ip router ospf|ip access-group|ip prefix-list|ipv6 prefix-list|ip access-list|route-map|vn-segment|member vni|route-target|channel-group|fabric forwarding|mtu|ip unnumbered|ip ospf network|switchport mode|switchport access vlan|ip forward|ipv6 address)\b/.match?(entry.text)
               issue(entry)
             else
               @cursor.mark(entry.index, state: :ignored)

data/lib/vxlan/cisco_nxos/parsers/show_vpc_brief.rb

@@ -19,11 +19,12 @@ module Vxlan
               section = :peer_links
             elsif line.match?(/\Aid\s+Port\s+Status\s+Consistency\s+Reason\s+Active vlans\z/i)
               section = :members
-            elsif (match = /\A(\d+)\s+(Po\d+)\s+(up|down)\s+(.+)\z/i.match(line)) && section
-              row = { id: match[1].to_i, interface: match[2], state: match[3].downcase }
+            elsif (match = /\A(\d+)\s+(Po\d+)\s+(up|down\*?)\s+(.+)\z/i.match(line)) && section
+              row = { id: match[1].to_i, interface: match[2], state: match[3].downcase.delete_suffix("*") }
+              row[:forwarding_via_peer_link] = true if match[3].end_with?("*")
               rest = match[4].split(/\s{2,}/)
               if section == :members
-                member = /\A(\S+)\s+(.+?)\s{2,}([\d, .-]+)\z/.match(match[4])
+                member = /\A(\S+)\s+(.+?)\s+([\d, .-]+)\z/.match(match[4])
                 unless member
                   unparsed_records(number)
                   next
@@ -36,7 +37,11 @@ module Vxlan
                 next
               end
               values[section] << row
-            elsif section && values[section].any? && line.match?(/\A[\d,.-]+\z/)
+            elsif section == :members && line.match?(/\AApplicable\s+Performed\z/) &&
+                values[:members].last&.values_at(:consistency, :reason) == [ "Not", "Consistency Check Not" ]
+              # NX-OS 将两个相邻列分别换行；只补齐已确认的同一成员。
+              values[:members].last.merge!(consistency: "Not Applicable", reason: "Consistency Check Not Performed")
+            elsif section && values[section].any? && line.match?(/\A[\d, .-]+\z/)
               values[section].last[:active_vlans_summary] += line
             elsif line == "Legend:"
               next
@@ -63,6 +68,7 @@ module Vxlan
           return unless @header
           missing = %i[domain_id peer_status keepalive_status consistency_status] - values.keys
           @issues << { code: :missing_vpc_fields, fields: missing } if missing.any?
+          @issues << { code: :incomplete_vpc_member } if values[:members].any? { |row| row[:consistency] == "Not" }
           values.values_at(:peer_links, :members).flatten.each { |row| row[:active_vlans_truncated] = row[:active_vlans_summary].include?("...") }
           count = values[:attributes]["Number of vPCs configured"]
           if count

data/lib/vxlan/cisco_nxos/syntax/policies.rb

@@ -7,6 +7,22 @@ module Vxlan
       module Policies
         private
 
+        # 地址组是 ACL 语义的一部分；未知成员不能当成空组或完整配置。
+        def address_group(block)
+          sequences, members = {}, []
+          analyze_children(block) do |child|
+            match = /\A(\d+) (host )?(\S+)\z/.match(child.text)
+            next issue(child) unless match
+            sequence = integer(match[1], 1..4_294_967_295)
+            raise ArgumentError if sequences.key?(sequence)
+            sequences[sequence] = true
+            value = match[3]
+            value = "#{ip_address(value)}/32" if match[2]
+            members << network_prefix(value, family: "ipv4")
+          end
+          members.uniq.sort
+        end
+
         # 解析有序 IP 前缀列表条目及匹配边界。
         def prefix_list(block, lists, family:)
           return ignore(block) if /\A(?:ip|ipv6) prefix-list \S+ description .+\z/.match?(block.text)

data/lib/vxlan/cisco_nxos/syntax/routing.rb

@@ -5,22 +5,19 @@ module Vxlan
     module Syntax
       # 路由作用域保留邻居、模板、VRF 与地址族的归属。
       module Routing
-        BGP_LEAF = /\A(?:no )?(?:remote-as|inherit peer|update-source|route-map|next-hop-self|route-reflector-client|advertise-pip|advertise l2vpn evpn|send-community|retain route-target)\b/
-        private_constant :BGP_LEAF
-
         private
 
         # 解析支持的路由作用域及协议关系。
         def routing(block, protocol, context = :process, family: nil, parent: nil)
           values = { vrfs: {}, neighbors: {}, templates: {}, address_families: {}, redistribute: [] }
+          neighbor_keys = {}
           analyze_children(block) do |child|
-            next issue(child) if protocol != :bgp && BGP_LEAF.match?(child.text)
             next issue(child) unless routing_leaf?(child.text, protocol, context, family, parent)
 
             case child.text
             when /\Avrf (\S+)\z/ then routing_scope(values, :vrfs, $1, child, protocol, context)
             when /\Atemplate peer (\S+)\z/ then routing_scope(values, :templates, $1, child, protocol, context)
-            when /\Aneighbor (\S+)\z/ then routing_scope(values, :neighbors, $1, child, protocol, context)
+            when /\Aneighbor (\S+)\z/ then routing_scope(values, :neighbors, $1, child, protocol, context, neighbor_keys: neighbor_keys)
             when /\Aaddress-family (.+)\z/ then routing_scope(values, :address_families, $1, child, protocol, context)
             when /\Arouter-id (\S+)\z/
               router_id = ip_address($1)
@@ -73,6 +70,8 @@ module Vxlan
         def routing_leaf?(text, protocol, context, family, parent)
           process_family = context == :address_families && %i[process vrfs].include?(parent)
           case text
+          when /\A(?:no )?(?:send-community|next-hop-self|route-reflector-client|advertise-pip|advertise l2vpn evpn)\b/
+            protocol == :bgp && context == :address_families
           when /\A(?:remote-as|inherit peer|update-source)\b/
             protocol == :bgp && %i[neighbors templates].include?(context)
           when /\Aroute-map\b/
@@ -92,7 +91,7 @@ module Vxlan
         end
 
         # 只进入当前事实模型可表达的子作用域，阻止任意递归及跨协议误归属。
-        def routing_scope(values, kind, name, block, protocol, context)
+        def routing_scope(values, kind, name, block, protocol, context, neighbor_keys: nil)
           supported = case kind
           when :vrfs then context == :process
           when :templates then protocol == :bgp && context == :process
@@ -103,6 +102,17 @@ module Vxlan
           end
           return issue(block) unless supported
 
+          # 邻居允许主机与动态前缀；坏身份只排除本块，保留同进程其他事实。
+          if kind == :neighbors
+            begin
+              canonical = name.include?("/") ? network_prefix(name) : ip_address(name)
+              # 身份索引用标准地址；事实键保留首次原文，重复项仍走统一的冲突与来源失效规则。
+              name = neighbor_keys[canonical] ||= name
+            rescue ArgumentError, IPAddr::Error
+              return issue(block, :invalid_configuration_value)
+            end
+          end
+
           conflicts_before = @configuration_conflict_count
           store_unique_fact(values[kind], name, block, path: @source_path + [ kind, name ]) do
             routing(block, protocol, kind, family: kind == :address_families ? name : nil, parent: context)