{
    "name"  : "是否正确配置极简网络",
    "problems" : {
        "miniNet" : {
            "desc"      : "【问题】极简网络未开启网关模式",
            "advice"    : ["【建议】开启网关模式，注意：需保存配置设备并重启后才能生效。"
                          ,"\t解决方案示例："
                          ,"\t\tRuijie#config"
                          ,"\t\tRuijie(config)#auth-mode gateway"
                          ,"\t\tRuijie(config)#en"
                          ,"\t\tRuijie#write"
                          ,"\t\tRuijie#reload"]
        },
        "vlan" : {
            "desc"      : "【问题】免认证VLAN数目配置过多导致在IP扫描攻击下CPU冒高",
            "advice"    : ["【建议】建议将减少免认证vlan个数，可修改为安全通道方式免认证 "
                          ,"配置举例： "
                          ,"\t原始配置如下，可以看到其中的免认证VLAN数超过100：${0}"
                          ,"\t假设2301-2700的地址段为202.201.128.0，修改后配置如下： "
                          ,"\t\texpert access-list extended ruijie "
                          ,"\t\t\t10 permit arp any any "
                          ,"\t\t\t20 permit udp any any eq bootps any any eq bootpc "
                          ,"\t\t\t30 permit udp any any eq bootpc any any eq bootps "
                          ,"\t\t\t100 permit ip 202.201.128.0 0.0.15.255 any any any "
                          ,"\t\t\texit"]
        },
        "ns" : {
            "desc"      : "【问题】极简网络端口下关闭NS报文抑制导致设备发送大量NS报文造成CPU利用率高。",
            "advice"    : ["【建议】建议打开NS报文抑制，防止设备发送大量NS报文功能。"
                          ,"\t解决方案示例："
                          ,"\t\tRuijie#config"
                          ,"\t\tRuijie(config)#interface vlan 1"
                          ,"\t\tRuijie(config-if-vlan)#ipv6 nd suppress-auth-vlan-ns"
                          ,"\t\tRuijie(config-if-vlan)#end"
                          ,"\t\tRuijie#write"]
        }
    }
}
---------------------------code-------------------------------
#是否极简网络
shareParam = {}
#shareParam.result = result
shareParam['isMiniNetGateOk'] = true

def checkFreeVlanNum(shareParam) :

    if shareParam.isMiniNetGateOk == false :
        return 'skip'
    end
    response = cli('show nfpp ip-guard hosts')
    if response.search('Invalid input | Unknown command.') != -1 :
        add_reason('无效指令：show nfpp ip-guard hosts')
        return 'skip'   
    end
 
    if response.match(/SCAN/) == null :
        return 'success'
    end
    
    response = cli('show direct-vlan')
    if response.search('Invalid input | Unknown command.') != -1 :
        add_reason('无效指令：show direct-vlan')
        return 'skip'   
    end
    matchResult = response.match(/[\r\n]+direct-vlan\s+[^\r\n]*/g)
    if matchResult == null :
        add_reason('匹配失败')
        return 'skip' 
    end
    matchResult = matchResult[0]
    range = matchResult.split(' ')
    range = range[1]
    numbers = parseRange(range)
    if numbers.length < 100 :
        return 'success'
    else :
        str = '\t\t'
        i = 0
        while i < numbers.length :
            if (i % 10 == 0 && i != 0) :
                str = str + '\t\t\r\n'
            end
            str = str + numbers[i] + ' '
            i = i + 1
        end
        add_problem('vlan',[str])
        return 'warn'
    end
end

def next(i) :
    if i >= vlans.length :
        response = cli('en')
        result = checkFreeVlanNum(shareParam)
        return result
    end
    cmd = 'interface vlan ' + vlan[i]
    i = i +  1
    response = cli(cmd)
    response = cli('show this')
    reg = /no ipv6 nd suppress-auth-vlan-ns/
    matchResult = response.match(reg)
    if matchResult != null :
        shareParam['isMiniNetGateOk'] = false
        add_problem('ns')
        return 'warn'
    end
    next(i)
end

def MinimalNetNdSuppressCheck(shareParam) :
    response = cli('show run | include auth-mode gateway')
    if response.search('Invalid input | Unknown command.') != -1 :
        add_reason('无效指令：show run | include auth-mode gateway')
        return 'skip'    
    end
    matchResult = ''
    reg = /\s*(\d+)\s+\S+\s+SUPER/g
    vlans = []
    if response.search('SUPER') != -1 :
        while true :
            matchResult = reg.exec(response)
            if matchResult != null :
                matchResultTemp = matchResult[1]
                vlans.push(matchResultTemp)
            else :
                break
            end
        end
    end
    
    if vlans.length == 0 :
        result = checkFreeVlanNum(shareParam)
        return result
    else :
        i = 0 
        response = cli('configure')
        result = next(i)
        return result
    end
end

isMiniNet =  precondition('isMiniNet')
if isMiniNet == undefined || isMiniNet == false :
    add_reason('不是极简网络')
    return 'skip'
end
response = cli('show run | include auth-mode gateway')
if response.search('Invalid input | Unknown command.') != -1 :
    add_reason('无效指令：show run | include auth-mode gateway')
    return 'skip'    
end
response = response.split('/\r?\n/')
response.shift()
response = response.join('\r\n')
reg = /auth-mode gateway/g
matchResult = response.match(reg)
if matchResult == null :
    shareParam['isMiniNetGateOk'] = false
    add_problem('miniNet')
    return 'warn'
end
res = MinimalNetNdSuppressCheck(shareParam)
return res

