confgraph 0.2.0__tar.gz → 0.3.7__tar.gz

confgraph-0.3.7/.github/workflows/publish.yml

@@ -0,0 +1,28 @@
+name: Publish to GitHub Packages
+
+on:
+  push:
+    tags: ["v*.*.*"]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.11"
+
+      - name: Build wheel
+        run: uv build --wheel
+
+      - name: Publish to GitHub Packages
+        run: |
+          uv publish \
+            --publish-url https://pypi.pkg.github.com/verigraphs/ \
+            --token ${{ secrets.GITHUB_TOKEN }}

confgraph-0.3.7/.github/workflows/redos-scan.yml

@@ -0,0 +1,48 @@
+name: redos-scan
+
+# CCR-0126: scan the parser regexes for catastrophic backtracking with a real
+# analyser (regexploit) and fail on a NEWLY introduced pathological pattern.
+# The current baseline is clean (0 findings over 784 patterns); this gate keeps
+# it that way. Runs on every change to the parsers or the scan itself, plus a
+# weekly sweep and manual dispatch. All within this repo — no secrets needed.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "confgraph/parsers/**"
+      - "tools/redos_scan.py"
+      - "tools/redos_baseline.json"
+      - ".github/workflows/redos-scan.yml"
+  pull_request:
+    paths:
+      - "confgraph/parsers/**"
+      - "tools/redos_scan.py"
+      - "tools/redos_baseline.json"
+      - ".github/workflows/redos-scan.yml"
+  schedule:
+    - cron: "0 8 * * 1"          # Mondays 08:00 UTC
+  workflow_dispatch:
+
+jobs:
+  redos:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.11"
+
+      # `uv run --extra redos` resolves confgraph + regexploit into uv's managed
+      # project env and runs there. (Not `uv pip install --system`: setup-uv
+      # provisions a uv-managed interpreter that refuses --system installs.)
+      - name: ReDoS gate
+        run: uv run --extra redos python tools/redos_scan.py --check
+
+      - name: Upload scan artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: redos-scan
+          path: tools/redos_scan.json

confgraph-0.3.7/.gitignore

@@ -0,0 +1,21 @@
+.venv/
+*.egg-info/
+__pycache__/
+*.pyc
+.DS_Store
+*.html
+.claude/
+temp/
+Self_Sustain_Parser_sys_design_v3.md
+configz.code-workspace
+docs/ConfigZ_Skills_Layer_Addendum_v3.1.md
+docs/_from_management_for_open_source.txt
+docs/poojan_notes.txt
+docs/self_sustaining_parser_system_design_v1.md
+docs/PRODUCT_ONE_PAGER.md
+_internal_docs/
+
+# Enterprise-only — lives in confgraph-entrp repo
+confgraph/simulation/
+samples/sim_topo/
+tests/

confgraph-0.3.7/.python-version

@@ -0,0 +1 @@
+3.11

confgraph-0.3.7/CHANGELOG.md

@@ -0,0 +1,67 @@
+# Changelog
+
+All notable changes to `confgraph` are documented here. The format is based on
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres
+to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.3.6] - 2026-07-27
+
+### Changed
+
+- **Op-primary parsers (IOS, NX-OS, EOS) no longer emit legacy tombstone
+  strings** into `ParsedConfig.no_commands`, `InterfaceConfig.no_commands`, or
+  `BGPConfig.no_commands` (CCR-0110 Phase E). This closes the one-release
+  deprecation window opened in 0.3.5: those fields are now **empty** on
+  op-primary parses. The Change-IR operation model (`ParsedConfig.change_ops`)
+  is unaffected — every removal that previously produced a tombstone string is
+  still emitted as a native `ChangeOp` with real provenance, so the composed
+  ChangeSet is byte-identical to 0.3.5.
+
+  **IOS-XR is excepted** (pending Phase 5): its deletion capability is carried
+  by derived tombstone strings (no native op sits behind them), so IOS-XR
+  continues to populate `no_commands` for its top-level and interface
+  deletions. **Three residual derived-only strings also survive on all OSes**
+  (each has no native op behind it — the string carries the deletion):
+  the whole-process `no router bgp <asn>` delete (`process:bgp:<asn>`) and the
+  OSPF area type resets (`field:ospf:<pid>:area:<n>:stub_reset` and
+  `...:nssa_reset`). All other OSPF-area deletion variants are op-backed and
+  emit no string.
+
+  The ops-to-legacy shim (`confgraph.change_ir.encode_legacy_shim`) is **not**
+  wired to refill the deprecated fields (owner-confirmed zero external
+  consumers, zero remaining engine readers). It survives as a **codec
+  artifact** — the inverse deriver that reconstructs the byte-exact legacy
+  string vocabulary from the composed ChangeSet — pinned against frozen
+  pre-removal goldens by the shim identity suite.
+
+  **Migration:** read change intent from `ParsedConfig.change_ops` (Change-IR)
+  instead of the `no_commands` string containers. The fields remain on the
+  model (empty) until removed at the next major version.
+
+## [0.3.5] - 2026-07-26
+
+### Deprecated
+
+- **`ParsedConfig.no_commands`, `InterfaceConfig.no_commands`, and
+  `BGPConfig.no_commands` are deprecated** (CCR-0025 Phase 4 / CCR-0110). These
+  tombstone fields record `no ...` negation lines in the legacy string
+  vocabulary. They are superseded by the Change-IR operation model
+  (`ParsedConfig.change_ops`), which represents the same intent as structured
+  `ChangeOp`s with real provenance.
+
+  The `CONFGRAPH_CHANGE_IR` default flipped to `ops` (2026-07-19). This release
+  starts the deprecation window: the fields stay **populated but deprecated for
+  one release cycle** (revised from two — CCR-0025 §8.2, owner decision
+  2026-07-25) — during the window they continue to carry what the parsers emit;
+  when parser tombstone emission retires (CCR-0110 Phase E) they are refilled by
+  the ops-to-legacy shim (`confgraph.change_ir.encode_legacy_shim`),
+  byte-identical, continuously verified by the shim's in-suite identity sweep.
+  In the release after this window the fields are emptied; they are removed
+  from the model only at the next **major** version, preserving schema
+  compatibility until then. `confgraph`'s own platform and engine consumers
+  already stopped reading the fields at the default flip.
+
+  **Migration:** read change intent from `ParsedConfig.change_ops` (Change-IR)
+  instead of the `no_commands` string containers.

confgraph-0.3.7/CLAUDE.md

@@ -0,0 +1,109 @@
+# Engineering Standards for This Project
+
+## Core Principle: Holistic Fixes, Never Patch Work
+
+Every fix or feature must address the **root cause**, not the symptom. Before writing a single line of code, complete the full understanding and planning phase below. A patch is any change that fixes the immediate case while leaving the structural problem intact — patches are not acceptable.
+
+A structural fix has one test: **adding the next similar thing (field, protocol, deletion type, scenario) requires exactly one code change per architectural layer.** If it requires changes in two places *within the same layer*, the fix is still a patch.
+
+When a fix legitimately spans two architectural layers (e.g. parser + merger), one entry per layer is the correct answer — not a patch. The test is whether those entries live in designated registries (one each) or whether they require editing business logic functions that were not supposed to grow.
+
+---
+
+## Mandatory Process for Every Fix or Feature
+
+### Step 1 — Understand the problem fully before touching code
+
+- Read the failing scenario, test, or bug report completely.
+- Identify the **symptom** (what breaks) and the **root cause** (why it breaks structurally).
+- Ask: is this a one-off missing case, or is there a class of similar cases that will keep appearing? If there is a class, the fix must address the class, not just the instance.
+- If the root cause is unclear, read more code. Do not guess.
+
+### Step 2 — Read the relevant code and understand intent
+
+- Read every file that touches the affected area — parser, model, merger, simulator, tests.
+- Understand what the code was designed to do, not just what it currently does. Look at existing patterns (registries, shared helpers, base class hooks) and understand why they were built that way.
+- Identify the **single point of truth** for the feature you're changing. All logic of a given kind should live in one place; if it's duplicated, the duplication is itself a structural problem.
+- Read the `_internal_docs/` directory if the area has a design document. The intent matters as much as the current implementation.
+
+### Step 3 — Design before coding
+
+- Write out in plain text: what is the root cause, what is the target end-state, and what files and methods change.
+- For every proposed change ask: does adding a new field / protocol / deletion type / scenario require touching this file again? If yes, redesign until the answer is no.
+- Identify all **call sites and callers** of the code you're changing. A fix that breaks a caller is not a fix.
+- Check whether the change affects both `confgraph/` (core parser/model) and `confgraph_entrp/` (simulation/merger). Changes to shared models or parsers ripple into the simulator.
+- Only proceed to coding once the design is clear and complete.
+
+### Step 4 — Define acceptance criteria before writing code
+
+Before touching any file, write down:
+- What must be true after the fix that is not true now (the positive test cases)?
+- What must still be true that was true before (the regression cases)?
+- What is the **parity check** — the test that proves the fix is structural and not a patch (e.g., adding a second field of the same type requires zero new code)?
+
+### Step 5 — Implement the solution
+
+- Follow the design from Step 3 exactly. If implementation reveals a flaw in the design, stop, go back to Step 3, and redesign. Do not improvise patches mid-implementation.
+- Build shared helpers before rewriting callers — never leave callers in a partially-migrated state.
+- One logical change per commit area. Do not mix unrelated fixes.
+- Do not add error handling, fallbacks, or validation for scenarios that cannot happen.
+- Do not add abstraction for hypothetical future requirements. Solve the class of problem that exists now.
+
+### Step 6 — Build tests that prove structural correctness
+
+Tests must verify the fix is structural, not just that the immediate case passes:
+
+- **Positive test**: the specific broken case now works.
+- **Parity test**: a second instance of the same class (second protocol, second field, second deletion type) works without any additional code changes.
+- **Regression test**: all existing scenarios produce identical output to before the fix.
+- **Negative test**: the system behaves correctly when the input is absent or malformed.
+
+Run tests before declaring the fix complete. If a regression appears, fix it before moving on.
+
+---
+
+## Concrete Anti-Patterns to Reject
+
+These are signs that a fix is patch work:
+
+| Pattern | Why it's a patch |
+|---|---|
+| Adding a new `if text == "new-field":` clause to a method that already has 10 similar clauses | The method is growing without a shared abstraction; the next field requires the same change |
+| Adding a new tombstone type by adding a new `elif tombstone.startswith("new:")` block inside a protocol-specific method | Tombstone handling should live in a shared registry; protocol-specific code should not need to grow |
+| Fixing a bug in one parsing path without checking whether the parallel path has the same bug | The two paths will diverge again on the next feature |
+| Adding a new scenario by working around a parser or merger limitation rather than fixing the limitation | The limitation will block the next scenario too |
+| Adding detection logic for a new trigger type when the underlying issue is that detection should be outcome-based | The trigger list will grow indefinitely |
+
+---
+
+## Project-Specific Structural Rules
+
+### Parser layer (`confgraph/parsers/`)
+
+- Every OS parser that has parallel code paths for the same concept (global vs VRF, IOS vs IOS-XR) must delegate to a **shared helper method**. The helper is the single source of truth. Callers call the helper; they do not re-implement the logic.
+- Adding a new `BGPNeighbor` field requires exactly one change in one parser method. If it requires changes in two methods, the paths have diverged and must be unified first.
+- Tombstone emission for nested `no` commands must be driven by a registry (`confgraph/tombstones.py`), not by per-protocol or per-method detection code. `parse_deletion_commands()` is the canonical traversal point.
+
+### Merger layer (`confgraph_entrp/simulation/merger.py`)
+
+- The deletion registry `_DELETION_RULES` is the single place to add new tombstone handlers. Adding a new tombstone type requires exactly one entry in `_DELETION_RULES` and one handler function — no changes to `_apply_deletions()` itself.
+- Field-level tombstone resolution uses `_reset_fields_from_tombstones()`. Do not add per-field special-case code in `_merge_bgp_instances()` or other merge functions.
+- Nested path navigation (for hierarchical tombstones) must use an explicit accessor registry, not eval or getattr chains.
+
+### Causal chain detection (`confgraph_entrp/simulation/snapshot.py`)
+
+- Adjacency loss detection must be **outcome-based** (compare adj_links before and after), not **trigger-based** (gate detection on whether a specific trigger type fired). A new class of protocol-config change must not require a new Layer 0x detector.
+- The reason resolver (`_resolve_adjacency_reason`) is the single place to add new reason strings.
+
+### Scenario testing (`demo_files/`)
+
+- Scenarios must test the real config change they describe. If a scenario uses a workaround because the parser or merger cannot handle the real command, the correct action is to fix the parser or merger — not to redesign the scenario.
+- Every scenario fix that reveals a structural gap must be accompanied by a fix to the structural gap, not just a scenario redesign.
+
+### Change requests (CCRs)
+
+Change requests against this repo are tracked in the platform repo:
+`~/ai/confgraph-platform/_internal_docs/core_change_requests/`. To file or update
+one from this session, use the **`ccr` skill** (`.claude/skills/ccr/SKILL.md`) — it
+covers scaffolding via `ccr.py`, validation, and the commit conventions. When a
+commit here implements a CCR, end its message with the trailer `CCR: CCR-00XX`.

confgraph-0.3.7/INTERFACE.md

@@ -0,0 +1,85 @@
+# confgraph — Public Interface Contract
+
+This file documents the interface that external tools (e.g. configz-validator) depend on.
+**Update this file whenever any of the below changes.**
+
+---
+
+## Package root
+
+```
+confgraph/
+```
+
+## Parsers
+
+| Class | Module |
+|---|---|
+| `BaseParser` | `confgraph.parsers.base` |
+| `ParseError` | `confgraph.parsers.base` |
+| `IOSParser` | `confgraph.parsers.ios_parser` |
+| `EOSParser` | `confgraph.parsers.eos_parser` |
+| `NXOSParser` | `confgraph.parsers.nxos_parser` |
+| `IOSXRParser` | `confgraph.parsers.iosxr_parser` |
+
+All parsers expose a single entry point:
+```python
+parsed: ParsedConfig = ParserClass(config_text: str).parse()
+```
+
+## Models root
+
+```
+confgraph/models/
+```
+
+## ParsedConfig fields
+
+| Field | Type |
+|---|---|
+| `source_os` | `OSType` |
+| `hostname` | `str \| None` |
+| `vrfs` | `list[VRFConfig]` |
+| `interfaces` | `list[InterfaceConfig]` |
+| `bgp_instances` | `list[BGPConfig]` |
+| `ospf_instances` | `list[OSPFConfig]` |
+| `isis_instances` | `list[ISISConfig]` |
+| `eigrp_instances` | `list[EIGRPConfig]` |
+| `rip_instances` | `list[RIPConfig]` |
+| `route_maps` | `list[RouteMapConfig]` |
+| `prefix_lists` | `list[PrefixListConfig]` |
+| `static_routes` | `list[StaticRoute]` |
+| `acls` | `list[ACLConfig]` |
+| `community_lists` | `list[CommunityListConfig]` |
+| `as_path_lists` | `list[ASPathListConfig]` |
+| `class_maps` | `list[ClassMapConfig]` |
+| `policy_maps` | `list[PolicyMapConfig]` |
+| `lines` | `list[LineConfig]` |
+| `ip_sla_operations` | `list[IPSLAOperation]` |
+| `eem_applets` | `list[EEMApplet]` |
+| `object_tracks` | `list[ObjectTrack]` |
+| `ntp` | `NTPConfig \| None` |
+| `snmp` | `SNMPConfig \| None` |
+| `syslog` | `SyslogConfig \| None` |
+| `banners` | `BannerConfig \| None` |
+| `nat` | `NATConfig \| None` |
+| `crypto` | `CryptoConfig \| None` |
+| `bfd` | `BFDConfig \| None` |
+| `multicast` | `MulticastConfig \| None` |
+| `raw_config` | `str` |
+| `unrecognized_blocks` | `list[UnrecognizedBlock]` |
+
+## OSType enum
+
+```python
+from confgraph.models.base import OSType
+# Values: OSType.IOS, OSType.IOS_XE, OSType.IOS_XR, OSType.NXOS, OSType.EOS
+```
+
+## BaseConfigObject
+
+All model objects (VRFConfig, BGPConfig, etc.) inherit from `BaseConfigObject` which provides:
+- `object_id: str`
+- `raw_lines: list[str]`
+- `line_numbers: list[int]`
+- `source_os: OSType`

{confgraph-0.2.0 → confgraph-0.3.7}/PKG-INFO

@@ -1,13 +1,14 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: confgraph
-Version: 0.2.0
+Version: 0.3.7
 Summary: Local-first network config dependency mapper — parse, visualize, and lint vendor configs
-Author-email: Poojan Patel <poojanpatel42@gmail.com>
-License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/verigraphs/confgraph
 Project-URL: Repository, https://github.com/verigraphs/confgraph
 Project-URL: Bug Tracker, https://github.com/verigraphs/confgraph/issues
-Keywords: network,cisco,arista,config,graph,visualization,bgp,ospf
+Author-email: Poojan Patel <poojanpatel42@gmail.com>
+License-Expression: Apache-2.0
+License-File: LICENSE
+Keywords: arista,bgp,cisco,config,graph,network,ospf,visualization
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: System Administrators
 Classifier: Intended Audience :: Telecommunications Industry
@@ -17,13 +18,15 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: System :: Networking
 Classifier: Topic :: Utilities
 Requires-Python: >=3.11
-Description-Content-Type: text/markdown
-License-File: LICENSE
 Requires-Dist: ciscoconfparse2>=0.9.16
+Requires-Dist: click>=8.1
 Requires-Dist: networkx>=3.6.1
 Requires-Dist: pydantic>=2.12.5
-Requires-Dist: click>=8.1
-Dynamic: license-file
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Provides-Extra: redos
+Requires-Dist: regexploit; extra == 'redos'
+Description-Content-Type: text/markdown
 
 # confgraph
 
@@ -71,6 +74,7 @@ Troubleshooting a BGP flap? The BGP cluster automatically pulls in related route
 | Cisco NX-OS | `NXOSParser` |
 | Arista EOS | `EOSParser` |
 | Juniper JunOS | `JunOSParser` |
+| Palo Alto PAN-OS | `PANOSParser` |
 
 ## Try it instantly
 
@@ -84,6 +88,8 @@ Pre-generated maps for all supported platforms — open any in your browser, no
 | Cisco NX-OS | [samples/nxos.txt](samples/nxos.txt) | [Live demo](https://verigraphs.github.io/confgraph/samples/nxos.html) |
 | Arista EOS | [samples/eos.txt](samples/eos.txt) | [Live demo](https://verigraphs.github.io/confgraph/samples/eos.html) |
 | Juniper JunOS | [samples/junos_test.cfg](samples/junos_test.cfg) | [Live demo](https://verigraphs.github.io/confgraph/samples/junos_test.html) |
+| Cisco IOS (full) | [samples/ios01.txt](samples/ios01.txt) | [Live demo](https://verigraphs.github.io/confgraph/samples/ios01.html) |
+| Palo Alto PAN-OS | [samples/panos_sample.xml](samples/panos_sample.xml) | [Live demo](https://verigraphs.github.io/confgraph/samples/panos_sample.html) |
 
 ## Install
 
@@ -101,7 +107,7 @@ uvx confgraph map router.txt
 
 ## Protocols parsed
 
-**BGP** · **OSPF** · **ACLs** · **NAT** · VRF · IS-IS · EIGRP · RIP · Route-maps · Prefix-lists · Community lists · AS-path lists · Static routes · NTP · SNMP · Syslog · Banners · QoS · Crypto/IPsec · BFD · IP SLA · EEM · Object tracking · Multicast
+**BGP** · **OSPF** · **ACLs** · **NAT** · **Crypto/IPsec** · VRF · IS-IS · EIGRP · RIP · Route-maps · Prefix-lists · Community lists · AS-path lists · Static routes · NTP · SNMP · Syslog · Banners · QoS · BFD · IP SLA · EEM · Object tracking · Multicast · Security zones (PAN-OS)
 
 ## Use as a library
 
@@ -117,6 +123,10 @@ print(parsed.route_maps)
 
 **Local-first by design.** confgraph never sends your config files anywhere. All parsing, graph generation, and analysis run entirely on your machine. The output is a single self-contained HTML file with no external requests — no CDN, no analytics, no telemetry. This means it can be safely moved to and used within air-gapped management jump-hosts where internet access is prohibited.
 
+## CLI Reference
+
+See [`docs/CLI_USAGE.md`](docs/CLI_USAGE.md) for all commands, options, and examples.
+
 ## Contributing
 
 Contributions welcome — new parsers, bug fixes, additional protocol coverage. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) to get started.

{confgraph-0.2.0 → confgraph-0.3.7}/README.md

@@ -44,6 +44,7 @@ Troubleshooting a BGP flap? The BGP cluster automatically pulls in related route
 | Cisco NX-OS | `NXOSParser` |
 | Arista EOS | `EOSParser` |
 | Juniper JunOS | `JunOSParser` |
+| Palo Alto PAN-OS | `PANOSParser` |
 
 ## Try it instantly
 
@@ -57,6 +58,8 @@ Pre-generated maps for all supported platforms — open any in your browser, no
 | Cisco NX-OS | [samples/nxos.txt](samples/nxos.txt) | [Live demo](https://verigraphs.github.io/confgraph/samples/nxos.html) |
 | Arista EOS | [samples/eos.txt](samples/eos.txt) | [Live demo](https://verigraphs.github.io/confgraph/samples/eos.html) |
 | Juniper JunOS | [samples/junos_test.cfg](samples/junos_test.cfg) | [Live demo](https://verigraphs.github.io/confgraph/samples/junos_test.html) |
+| Cisco IOS (full) | [samples/ios01.txt](samples/ios01.txt) | [Live demo](https://verigraphs.github.io/confgraph/samples/ios01.html) |
+| Palo Alto PAN-OS | [samples/panos_sample.xml](samples/panos_sample.xml) | [Live demo](https://verigraphs.github.io/confgraph/samples/panos_sample.html) |
 
 ## Install
 
@@ -74,7 +77,7 @@ uvx confgraph map router.txt
 
 ## Protocols parsed
 
-**BGP** · **OSPF** · **ACLs** · **NAT** · VRF · IS-IS · EIGRP · RIP · Route-maps · Prefix-lists · Community lists · AS-path lists · Static routes · NTP · SNMP · Syslog · Banners · QoS · Crypto/IPsec · BFD · IP SLA · EEM · Object tracking · Multicast
+**BGP** · **OSPF** · **ACLs** · **NAT** · **Crypto/IPsec** · VRF · IS-IS · EIGRP · RIP · Route-maps · Prefix-lists · Community lists · AS-path lists · Static routes · NTP · SNMP · Syslog · Banners · QoS · BFD · IP SLA · EEM · Object tracking · Multicast · Security zones (PAN-OS)
 
 ## Use as a library
 
@@ -90,6 +93,10 @@ print(parsed.route_maps)
 
 **Local-first by design.** confgraph never sends your config files anywhere. All parsing, graph generation, and analysis run entirely on your machine. The output is a single self-contained HTML file with no external requests — no CDN, no analytics, no telemetry. This means it can be safely moved to and used within air-gapped management jump-hosts where internet access is prohibited.
 
+## CLI Reference
+
+See [`docs/CLI_USAGE.md`](docs/CLI_USAGE.md) for all commands, options, and examples.
+
 ## Contributing
 
 Contributions welcome — new parsers, bug fixes, additional protocol coverage. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) to get started.

{confgraph-0.2.0 → confgraph-0.3.7}/confgraph/analysis/dependency_resolver.py

@@ -21,6 +21,7 @@ from __future__ import annotations
 from pydantic import BaseModel, Field
 
 from confgraph.models.parsed_config import ParsedConfig
+from confgraph.utils.interface import is_discard_interface
 
 
 # ---------------------------------------------------------------------------
@@ -95,6 +96,10 @@ class DependencyResolver:
         self._class_maps = {cm.name: cm for cm in config.class_maps}
         self._policy_maps = {pm.name: pm for pm in config.policy_maps}
         self._ip_sla_ops = {op.sla_id: op for op in config.ip_sla_operations}
+        self._ospf_instances = {
+            f"{o.process_id}" + (f" vrf {o.vrf}" if o.vrf else ""): o
+            for o in config.ospf_instances
+        }
 
         # Track which named objects have been referenced (for orphan detection)
         self._referenced: dict[str, set[str]] = {
@@ -121,6 +126,7 @@ class DependencyResolver:
         links.extend(self._resolve_eigrp())
         links.extend(self._resolve_rip())
         links.extend(self._resolve_interfaces())
+        links.extend(self._resolve_vrfs())
         links.extend(self._resolve_route_maps())
         links.extend(self._resolve_static_routes())
         links.extend(self._resolve_ntp())
@@ -132,6 +138,7 @@ class DependencyResolver:
         links.extend(self._resolve_ipsla())
         links.extend(self._resolve_object_tracking())
         links.extend(self._resolve_multicast())
+        links.extend(self._resolve_zones())
 
         orphaned = self._find_orphans()
         return DependencyReport(links=links, orphaned=orphaned)
@@ -302,10 +309,31 @@ class DependencyResolver:
                 links.append(self._link(
                     "interface", iface.name, "unnumbered_source", "interface", iface.unnumbered_source,
                 ))
+            # PAN-OS BGP-over-IPSec-VPN underlay (CCR-0116): a tunnel.N carrying a
+            # resolved physical egress depends on that egress interface, so the
+            # graph chains bgp_instance -> tunnel.N -> ethernet1/N.  Field-driven,
+            # so no OS branching: non-PAN-OS interfaces leave it None.
+            if iface.tunnel_underlay_interface:
+                links.append(self._link(
+                    "interface", iface.name, "tunnel_underlay",
+                    "interface", iface.tunnel_underlay_interface,
+                ))
+            # Surface the IPSec/IKE hop the tunnel rides as an edge to the
+            # per-device crypto node (only when crypto config was parsed, so no
+            # ghost node is invented).
+            if iface.tunnel_ike_gateway and self._config.crypto is not None:
+                links.append(self._link(
+                    "interface", iface.name, "tunnel_ike_gateway", "crypto", "crypto",
+                ))
             if iface.acl_in:
                 links.append(self._link("interface", iface.name, "acl_in", "acl", iface.acl_in))
             if iface.acl_out:
                 links.append(self._link("interface", iface.name, "acl_out", "acl", iface.acl_out))
+            if iface.ospf_process_id is not None:
+                ospf_node_id = f"{iface.ospf_process_id}" + (f" vrf {iface.vrf}" if iface.vrf else "")
+                links.append(self._link(
+                    "interface", iface.name, "ospf_process", "ospf_instance", ospf_node_id,
+                ))
         return links
 
     # ------------------------------------------------------------------
@@ -334,6 +362,14 @@ class DependencyResolver:
     def _infer_match_ref_type(match_type: str) -> str | None:
         """Map a route-map match_type string to its referenced object type."""
         mt = match_type.lower()
+        # An INLINE match references nothing: its values are literal patterns or
+        # prefixes, not the names of objects. Cisco matches an as-path by naming
+        # an as-path access-list; PAN-OS carries the regex in the policy rule
+        # itself. Inferring a reference from those values would manufacture a
+        # dangling ref for every such rule — the harm this method exists to
+        # avoid. Parsers signal the inline case with a "-regex" suffix.
+        if mt.endswith("-regex") or mt.endswith(" regex"):
+            return None
         if "prefix-list" in mt:
             return "prefix_list"
         if "as-path" in mt:
@@ -355,13 +391,41 @@ class DependencyResolver:
                 links.append(self._link(
                     "static_route", str(sr.destination), "vrf", "vrf", sr.vrf,
                 ))
-            if sr.next_hop_interface:
+            # Null0 / NullN and each vendor's discard target are blackhole
+            # pseudo-interfaces: traffic is dropped, no InterfaceConfig exists.
+            # They are routing sinks, not resolvable objects, so emit no link
+            # (skipping avoids a false dangling-interface ERROR). See
+            # confgraph.utils.interface.is_discard_interface for the vendor table.
+            if sr.next_hop_interface and not is_discard_interface(sr.next_hop_interface):
                 links.append(self._link(
                     "static_route", str(sr.destination),
                     "next_hop_interface", "interface", sr.next_hop_interface,
                 ))
         return links
 
+    # ------------------------------------------------------------------
+    # VRFs
+    # ------------------------------------------------------------------
+
+    def _resolve_vrfs(self) -> list[DependencyLink]:
+        """Resolve VRF import/export route-map references.
+
+        Without this, VRF route-maps are never marked referenced and are
+        wrongly reported as orphaned. Where a VRF has no route-map, no edge
+        is emitted.
+        """
+        links: list[DependencyLink] = []
+        for vrf in self._config.vrfs:
+            if vrf.route_map_import:
+                links.append(self._link(
+                    "vrf", vrf.name, "route_map_import", "route_map", vrf.route_map_import,
+                ))
+            if vrf.route_map_export:
+                links.append(self._link(
+                    "vrf", vrf.name, "route_map_export", "route_map", vrf.route_map_export,
+                ))
+        return links
+
     # ------------------------------------------------------------------
     # Orphan detection
     # ------------------------------------------------------------------
@@ -422,8 +486,13 @@ class DependencyResolver:
             "acl":            self._acls,
             "vrf":            self._vrfs,
             "interface":      self._interfaces,
+            "ospf_instance":  self._ospf_instances,
             "class_map":      self._class_maps,
             "policy_map":     self._policy_maps,
+            # The crypto config is a per-device singleton node named "crypto"
+            # (GraphBuilder). A tunnel→crypto underlay hop (CCR-0116) resolves
+            # iff that node exists.
+            "crypto":         {"crypto": self._config.crypto} if self._config.crypto else {},
         }.get(ref_type, {})
         return ref_name in index
 
@@ -659,3 +728,15 @@ class DependencyResolver:
         if mc.vrf:
             links.append(self._link("multicast", "multicast", "vrf", "vrf", mc.vrf))
         return links
+
+    # ------------------------------------------------------------------
+    # PAN-OS Zones
+    # ------------------------------------------------------------------
+
+    def _resolve_zones(self) -> list[DependencyLink]:
+        """Emit zone → interface edges for PAN-OS zone configurations."""
+        links: list[DependencyLink] = []
+        for zone in self._config.zones:
+            for iface_name in zone.interfaces:
+                links.append(self._link("zone", zone.name, "interface", "interface", iface_name))
+        return links