@oneuptime/common 12.0.34 → 13.0.0

package/build/dist/Utils/Monitor/NetworkTopologyUtil.js

@@ -57,6 +57,17 @@ function isIpv4Address(value) {
 }
 // Endpoint nodes rendered per graph; the slice is deterministic (by MAC).
 const ENDPOINT_RENDER_CAP = 2000;
+/*
+ * The built-in roles that sit at the top of a network, for the parent rule
+ * in drawAdoptedEndpoint when the project has not stamped its own answer.
+ * Mirrors the isCoreLayer flags in DEFAULT_NETWORK_DEVICE_ROLES, which is
+ * the seed every project's role table starts from.
+ */
+const BUILT_IN_CORE_LAYER_ROLES = new Set([
+    "router",
+    "firewall",
+    "loadBalancer",
+]);
 /*
  * How long an ARP/FDB-learned endpoint keeps its "up" colour after the last
  * walk that saw it. Taken from the shared device rule at its default
@@ -128,6 +139,12 @@ export default class NetworkTopologyUtil {
         }
         // Kept aside so the diagnostics pass below can read it back per node.
         const isNeighborDiscoveryEnabledById = new Map();
+        /*
+         * Managed nodes by id, for the endpoint adoption pass: a device found
+         * in a switch's forwarding table is stamped with what the table knew
+         * about it (MAC, address, VLAN), and the parent rule reads its role.
+         */
+        const deviceNodeById = new Map();
         for (const device of devices) {
             isNeighborDiscoveryEnabledById.set(device.id, device.isNeighborDiscoveryEnabled);
             const deviceRole = resolveDeviceRole(device.deviceRole, {
@@ -150,6 +167,13 @@ export default class NetworkTopologyUtil {
                 sysName: device.sysName,
                 vendor: device.vendor,
                 deviceModel: device.deviceModel,
+                /*
+                 * The declared or learned MAC, whether or not a forwarding table
+                 * has found it yet: the drawer shows it, and an operator checking
+                 * why a device floats wants to see what the map was looking for.
+                 * Normalised so it reads the same as the endpoint rows beside it.
+                 */
+                macAddress: normalizeMac(device.macAddress),
             };
             /*
              * The configured role, when the project has one for this key. The
@@ -159,6 +183,7 @@ export default class NetworkTopologyUtil {
              */
             applyRoleStamp(deviceNode, stampForRoleKey(roleKeyForNode(device.deviceRole, deviceRole), roleIndex));
             nodes.push(deviceNode);
+            deviceNodeById.set(device.id, deviceNode);
         }
         const edgeByKey = new Map();
         /*
@@ -442,6 +467,19 @@ export default class NetworkTopologyUtil {
         let droppedEndpointCount = 0;
         let renderedEndpointCount = 0;
         let endpointsTruncated = false;
+        let adoptedEndpointCount = 0;
+        /*
+         * --- Endpoints that ARE managed devices ---
+         *
+         * A ping-only register, handset or kiosk is a NetworkDevice with a node
+         * of its own, and it is ALSO a MAC some switch learned on an access
+         * port - which until now was drawn as a second, anonymous node hanging
+         * off that switch while the device's own node floated with no link at
+         * all (issue #3489). The index below is what lets the two be recognised
+         * as one box, so the forwarding-table evidence draws the device's cable
+         * instead of a stranger's.
+         */
+        const adoption = NetworkTopologyUtil.planEndpointAdoption(devices, sortedEndpoints, deviceNodeIds, now);
         for (const endpoint of sortedEndpoints) {
             if (!endpoint.attachedNetworkDeviceId ||
                 !deviceNodeIds.has(endpoint.attachedNetworkDeviceId)) {
@@ -449,6 +487,25 @@ export default class NetworkTopologyUtil {
                 droppedEndpointCount++;
                 continue;
             }
+            const adoptedDevice = adoption.deviceByEndpointId.get(endpoint.id);
+            if (adoptedDevice) {
+                /*
+                 * Counted before the render cap, and never against it: an adopted
+                 * endpoint mints no node, so it cannot crowd out one that does.
+                 */
+                adoptedEndpointCount++;
+                if (adoption.drawnEndpointIds.has(endpoint.id)) {
+                    NetworkTopologyUtil.drawAdoptedEndpoint({
+                        endpoint: endpoint,
+                        device: adoptedDevice,
+                        deviceNode: deviceNodeById.get(adoptedDevice.id),
+                        edgeByKey: edgeByKey,
+                        edges: edges,
+                        interfaceByDeviceAndIndex: interfaceByDeviceAndIndex,
+                    });
+                }
+                continue;
+            }
             if (renderedEndpointCount >= ENDPOINT_RENDER_CAP) {
                 endpointsTruncated = true;
                 continue;
@@ -500,6 +557,7 @@ export default class NetworkTopologyUtil {
                 toNodeId: nodeId,
                 fromPort: fromPort,
                 protocols: ["fdb"],
+                learnedByNodeId: endpoint.attachedNetworkDeviceId,
                 fromInterface: switchInterface
                     ? {
                         interfaceIndex: switchInterface.interfaceIndex,
@@ -529,6 +587,7 @@ export default class NetworkTopologyUtil {
                 edges,
                 droppedEndpointCount,
                 endpointsTruncated,
+                adoptedEndpointCount,
                 suppressedNodeCount: 0,
             };
         }
@@ -546,9 +605,425 @@ export default class NetworkTopologyUtil {
             }),
             droppedEndpointCount,
             endpointsTruncated,
+            adoptedEndpointCount,
             suppressedNodeCount: nodes.length - visibleNodes.length,
         };
     }
+    /*
+     * Which endpoints are managed devices, and which ONE of them draws the
+     * device's cable.
+     *
+     * A device can match more than one row. The common way is hardware that
+     * was swapped keeping its address: the old unit's MAC is still a row in
+     * the endpoint table (nothing prunes it), stored on the device from the
+     * ARP pass, and the new unit's MAC is a fresher row that matches the
+     * device by address. Drawing both would put the register on two ports
+     * at once, one of them a port nothing has been plugged into for a
+     * month. So every matching row is ADOPTED - none of them is minted as a
+     * stranger - and the most recently seen one draws the link. A MAC match
+     * outranks an address match at equal freshness, and the MAC order the
+     * caller already sorted by settles the rest, so the choice never depends
+     * on query order.
+     *
+     * The price is that a genuinely dual-homed device draws one cable. That
+     * is rare among the devices this exists for, and it is the honest
+     * trade: one current cable beats one current and one stale.
+     */
+    static planEndpointAdoption(devices, sortedEndpoints, deviceNodeIds, now) {
+        const index = NetworkTopologyUtil.buildEndpointAdoptionIndex(devices);
+        const deviceByEndpointId = new Map();
+        const drawnEndpointIds = new Set();
+        if (index.size === 0) {
+            return { deviceByEndpointId, drawnEndpointIds };
+        }
+        const candidatesByDeviceId = new Map();
+        for (const endpoint of sortedEndpoints) {
+            if (!endpoint.attachedNetworkDeviceId ||
+                !deviceNodeIds.has(endpoint.attachedNetworkDeviceId)) {
+                continue;
+            }
+            const match = NetworkTopologyUtil.adoptionMatchForEndpoint(endpoint, index);
+            if (!match) {
+                continue;
+            }
+            /*
+             * An address is only evidence while it is current. A MAC names a
+             * box for good, but an address is re-leased: a row the ARP pass
+             * bound months ago may name a laptop that held the register's
+             * address before the register was plugged in. Such a row is left to
+             * be drawn as the stale (down-coloured) endpoint it is, rather than
+             * cabling the device to a stranger's port with a live node's
+             * confidence. The window is the one endpoint nodes age out on.
+             */
+            if (!match.matchedByMac &&
+                !NetworkTopologyUtil.isFreshSighting(endpoint, now)) {
+                continue;
+            }
+            deviceByEndpointId.set(endpoint.id, match.device);
+            const bucket = candidatesByDeviceId.get(match.device.id);
+            const candidate = {
+                endpoint: endpoint,
+                matchedByMac: match.matchedByMac,
+            };
+            if (bucket) {
+                bucket.push(candidate);
+            }
+            else {
+                candidatesByDeviceId.set(match.device.id, [candidate]);
+            }
+        }
+        for (const candidates of candidatesByDeviceId.values()) {
+            let chosen = candidates[0];
+            for (const candidate of candidates.slice(1)) {
+                if (NetworkTopologyUtil.isFresherSighting(candidate, chosen)) {
+                    chosen = candidate;
+                }
+            }
+            drawnEndpointIds.add(chosen.endpoint.id);
+        }
+        return { deviceByEndpointId, drawnEndpointIds };
+    }
+    static isFreshSighting(endpoint, now) {
+        if (!endpoint.lastSeenAt) {
+            return false;
+        }
+        const ageMs = now.getTime() - new Date(endpoint.lastSeenAt).getTime();
+        return ageMs <= ENDPOINT_FRESH_WINDOW_MS;
+    }
+    /*
+     * Strictly fresher: later lastSeenAt, then a MAC match over an address
+     * match. Equal on both keeps the incumbent, which is the earlier entry
+     * in MAC order.
+     */
+    static isFresherSighting(candidate, incumbent) {
+        const candidateSeen = candidate.endpoint.lastSeenAt
+            ? new Date(candidate.endpoint.lastSeenAt).getTime()
+            : Number.NEGATIVE_INFINITY;
+        const incumbentSeen = incumbent.endpoint.lastSeenAt
+            ? new Date(incumbent.endpoint.lastSeenAt).getTime()
+            : Number.NEGATIVE_INFINITY;
+        if (candidateSeen !== incumbentSeen) {
+            return candidateSeen > incumbentSeen;
+        }
+        return candidate.matchedByMac && !incumbent.matchedByMac;
+    }
+    /*
+     * Every key an endpoint could be recognised as a managed device by.
+     *
+     * Two kinds, strongest first:
+     *
+     *  "mac" - the device's declared or ARP-learned MAC against the MAC the
+     *          switch learned. A MAC is unique per project among endpoints
+     *          (the endpoint table enforces it), so this needs no scoping.
+     *  "ip"  - the device's hostname, when it is an IPv4 literal, against
+     *          the address a router's ARP table bound the MAC to. Scoped to
+     *          the SITE: every branch has a 10.0.0.5, and an unscoped match
+     *          would cable one register in every store to whichever switch
+     *          happened to learn a MAC that answers at that address. No site
+     *          on either side is a site of its own, so a project that never
+     *          set sites up still matches - project-wide, as it has to.
+     *
+     * The same ambiguity guard as the neighbour matcher: a key two devices
+     * both claim is deleted rather than resolved, because a cable drawn to
+     * the wrong box is worse than one not drawn.
+     *
+     * Interface MACs (TopologyDeviceInput.macAddresses) are deliberately NOT
+     * keys here. A walked switch's interface MACs turn up in its uplink
+     * neighbours' forwarding tables as transit traffic, and adopting those
+     * would redraw every switch-to-switch cable LLDP already reports from a
+     * weaker source. The declared MAC is different in kind: an operator (or
+     * the ARP pass) put it there to say "this is the box".
+     */
+    static buildEndpointAdoptionIndex(devices) {
+        const index = new Map();
+        const ambiguous = new Set();
+        for (const device of devices) {
+            for (const key of NetworkTopologyUtil.adoptionKeysForDevice(device)) {
+                const existing = index.get(key);
+                if (existing && existing.id !== device.id) {
+                    ambiguous.add(key);
+                    continue;
+                }
+                index.set(key, device);
+            }
+        }
+        /*
+         * A walked device's interface MACs are not adoption keys (see above),
+         * but they ARE evidence about who owns a MAC. A declared MAC that some
+         * walked device reports as one of its own interfaces is a contradiction
+         * - a register registered at a switch's SVI address and stamped with
+         * the switch's MAC, say - and the neighbour matcher already refuses
+         * that key. Refusing it here too keeps the two from disagreeing about
+         * which box a MAC is.
+         */
+        for (const device of devices) {
+            for (const rawMac of device.macAddresses || []) {
+                const mac = normalizeMac(rawMac);
+                if (!mac) {
+                    continue;
+                }
+                const key = NetworkTopologyUtil.adoptionMacKey(mac);
+                const claimant = index.get(key);
+                if (claimant && claimant.id !== device.id) {
+                    ambiguous.add(key);
+                }
+            }
+        }
+        for (const key of ambiguous) {
+            index.delete(key);
+        }
+        return index;
+    }
+    static adoptionKeysForDevice(device) {
+        const keys = [];
+        const mac = normalizeMac(device.macAddress);
+        if (mac) {
+            keys.push(NetworkTopologyUtil.adoptionMacKey(mac));
+        }
+        /*
+         * hostname only, never `name`: a name is an operator's label, and one
+         * that happens to be an IP literal is not a claim that the device
+         * answers there - the same line matchKeysForDevice draws.
+         */
+        const hostname = NetworkTopologyUtil.normalizeKey(device.hostname);
+        if (isIpv4Address(hostname)) {
+            keys.push(NetworkTopologyUtil.adoptionIpKey(device.siteId, hostname));
+        }
+        return keys;
+    }
+    /*
+     * The device this endpoint is, if it is one, and by which evidence. MAC
+     * first: it is the stronger claim, and the only one that survives an
+     * address change.
+     */
+    static adoptionMatchForEndpoint(endpoint, index) {
+        const mac = normalizeMac(endpoint.macAddress);
+        if (mac) {
+            const byMac = index.get(NetworkTopologyUtil.adoptionMacKey(mac));
+            if (byMac) {
+                return { device: byMac, matchedByMac: true };
+            }
+        }
+        const ip = NetworkTopologyUtil.normalizeKey(endpoint.ipAddress);
+        if (isIpv4Address(ip)) {
+            const byIp = index.get(NetworkTopologyUtil.adoptionIpKey(endpoint.siteId, ip));
+            if (byIp) {
+                return { device: byIp, matchedByMac: false };
+            }
+        }
+        return undefined;
+    }
+    static adoptionMacKey(normalizedMac) {
+        return `mac\u0000${normalizedMac}`;
+    }
+    static adoptionIpKey(siteId, normalizedIp) {
+        /*
+         * null, undefined, "" and whitespace all normalise to the same "no
+         * site" key - the convention NetworkDeviceLinkRuleUtil already uses.
+         */
+        const siteKey = (siteId || "").trim();
+        return `ip\u0000${siteKey}\u0000${normalizedIp}`;
+    }
+    /*
+     * Draws one adopted endpoint: an "fdb" edge from the switch that learned
+     * the MAC to the device's own node, merged into whatever edge already
+     * joins that pair, plus the identity the tables knew stamped on the node.
+     *
+     * A device found in its OWN tables is a self-reference (its address in
+     * its own ARP cache, say) and draws nothing - an edge from a node to
+     * itself is not a cable. It still counts as adopted: the row is not an
+     * endpoint, and it must not be minted as one.
+     */
+    static drawAdoptedEndpoint(data) {
+        var _a;
+        const switchId = data.endpoint.attachedNetworkDeviceId;
+        const deviceId = data.device.id;
+        if (data.deviceNode) {
+            NetworkTopologyUtil.stampAdoptedIdentity(data.deviceNode, data.endpoint);
+        }
+        if (switchId === deviceId) {
+            return;
+        }
+        // Port label + interface state on the switch end, when identifiable.
+        let switchInterface = undefined;
+        if (data.endpoint.attachedInterfaceIndex !== undefined) {
+            switchInterface = data.interfaceByDeviceAndIndex.get(`${switchId}::${data.endpoint.attachedInterfaceIndex}`);
+        }
+        let switchPort = data.endpoint.attachedPortName || (switchInterface === null || switchInterface === void 0 ? void 0 : switchInterface.name);
+        if (!switchPort && data.endpoint.attachedInterfaceIndex !== undefined) {
+            switchPort = `if${data.endpoint.attachedInterfaceIndex}`;
+        }
+        const switchEndpoint = switchInterface
+            ? {
+                interfaceIndex: switchInterface.interfaceIndex,
+                interfaceName: switchInterface.name,
+                isOperationallyUp: switchInterface.isOperationallyUp,
+                isAdministrativelyUp: switchInterface.isAdministrativelyUp,
+                utilizationPercent: switchInterface.utilizationPercent,
+                inRateMbps: switchInterface.inRateMbps,
+                outRateMbps: switchInterface.outRateMbps,
+                errorsPerSecond: switchInterface.errorsPerSecond,
+            }
+            : undefined;
+        /*
+         * Which end is up. A forwarding table is not symmetric the way a
+         * neighbour protocol is: the switch LEARNED this MAC on an access
+         * port, which is a statement that the device hangs off it - for a
+         * register, a phone, a camera, a server. It is no such statement
+         * about a router or a firewall, whose MAC a switch learns on the port
+         * that leads UPSTREAM, nor about another switch, where the table says
+         * nothing about which of the two is nearer the core. Those are left
+         * for the layout to infer, exactly as an LLDP edge is.
+         */
+        const declaredParentId = NetworkTopologyUtil.isLearningSwitchTheParent(data.deviceNode)
+            ? switchId
+            : undefined;
+        const edgeKey = [switchId, deviceId].sort().join("::");
+        const existing = data.edgeByKey.get(edgeKey);
+        if (!existing) {
+            const edge = {
+                fromNodeId: switchId,
+                toNodeId: deviceId,
+                fromPort: switchPort,
+                protocols: ["fdb"],
+                fromInterface: switchEndpoint,
+                parentNodeId: declaredParentId,
+                learnedByNodeId: switchId,
+            };
+            data.edgeByKey.set(edgeKey, edge);
+            data.edges.push(edge);
+            return;
+        }
+        /*
+         * The pair is already joined - by a neighbour protocol, by a link the
+         * operator drew, or by both. Merge rather than double the line.
+         */
+        if (existing.protocols && !existing.protocols.includes("fdb")) {
+            existing.protocols.push("fdb");
+        }
+        /*
+         * Which end learned. The existing edge may be stored device→switch,
+         * so this is the only reliable statement of which end the table
+         * belongs to; the freshest sighting draws, so a later one does not
+         * move it.
+         */
+        existing.learnedByNodeId = existing.learnedByNodeId || switchId;
+        /*
+         * The switch-end port. Measured beats typed: against a hand-drawn
+         * link the forwarding table's port replaces whatever was typed,
+         * because the operator's port is a best recollection and this is
+         * what the switch actually reports. Against a neighbour protocol both
+         * are measured, and the protocol's is kept - it names the port from
+         * both ends, where the table only knows one.
+         */
+        const isMeasuredAlready = Boolean((_a = existing.protocols) === null || _a === void 0 ? void 0 : _a.some((protocol) => {
+            return protocol === "lldp" || protocol === "cdp";
+        }));
+        const switchIsFromEnd = existing.fromNodeId === switchId;
+        const existingPort = switchIsFromEnd
+            ? existing.fromPort
+            : existing.toPort;
+        const existingInterface = switchIsFromEnd ? existing.fromInterface : existing.toInterface;
+        let mergedPort;
+        let mergedInterface;
+        if (!isMeasuredAlready) {
+            mergedPort = switchPort || existingPort;
+            mergedInterface = NetworkTopologyUtil.mergeEndpoints(switchEndpoint, existingInterface);
+        }
+        else if (NetworkTopologyUtil.describesSamePort(existingInterface, existingPort, switchEndpoint, switchPort)) {
+            /*
+             * Two reports of ONE port: the protocol's fields are kept and the
+             * table fills whatever the protocol's report left blank.
+             */
+            mergedPort = existingPort || switchPort;
+            mergedInterface = NetworkTopologyUtil.mergeEndpoints(existingInterface, switchEndpoint);
+        }
+        else {
+            /*
+             * Two reports of DIFFERENT ports - the device was re-patched and the
+             * table has caught up before the neighbour protocol, or the other
+             * way round. Splicing the two field by field would label the
+             * protocol's port with the other port's name and paint it with the
+             * other port's state, so the protocol's end is left whole and the
+             * table's port is not shown until the two agree.
+             */
+            mergedPort = existingPort;
+            mergedInterface = existingInterface;
+        }
+        if (switchIsFromEnd) {
+            existing.fromPort = mergedPort;
+            existing.fromInterface = mergedInterface;
+        }
+        else {
+            existing.toPort = mergedPort;
+            existing.toInterface = mergedInterface;
+        }
+        /*
+         * A hierarchy somebody DECLARED - on the link, or through a rule -
+         * beats the one the table implies. The specific statement beats the
+         * general one, the same precedence the manual-link merge applies.
+         */
+        existing.parentNodeId = existing.parentNodeId || declaredParentId;
+    }
+    /*
+     * Whether a neighbour protocol's report of the switch end and the
+     * forwarding table's attachment name the same port. By ifIndex when both
+     * know it; by port label when the protocol's end has no interface row
+     * behind it. Unknown on both sides is not "the same" - it is nothing to
+     * compare, and the protocol's end is kept as it was.
+     */
+    static describesSamePort(existingInterface, existingPort, switchEndpoint, switchPort) {
+        if ((existingInterface === null || existingInterface === void 0 ? void 0 : existingInterface.interfaceIndex) !== undefined &&
+            (switchEndpoint === null || switchEndpoint === void 0 ? void 0 : switchEndpoint.interfaceIndex) !== undefined) {
+            return existingInterface.interfaceIndex === switchEndpoint.interfaceIndex;
+        }
+        const existingLabel = NetworkTopologyUtil.normalizeKey((existingInterface === null || existingInterface === void 0 ? void 0 : existingInterface.interfaceName) || existingPort);
+        const switchLabel = NetworkTopologyUtil.normalizeKey((switchEndpoint === null || switchEndpoint === void 0 ? void 0 : switchEndpoint.interfaceName) || switchPort);
+        return (existingLabel !== undefined &&
+            switchLabel !== undefined &&
+            existingLabel === switchLabel);
+    }
+    /*
+     * What the tables knew about the device, onto its node, so the detail
+     * drawer can show the MAC, the address and the VLAN it was learned on.
+     * Fills gaps only: a MAC the operator declared is already the one that
+     * matched, and an address the row carries is left as it is.
+     */
+    static stampAdoptedIdentity(node, endpoint) {
+        const mac = normalizeMac(endpoint.macAddress);
+        if (mac && !node.macAddress) {
+            node.macAddress = mac;
+        }
+        if (endpoint.ipAddress && !node.ipAddress) {
+            node.ipAddress = endpoint.ipAddress;
+        }
+        if (typeof endpoint.vlanId === "number" && node.vlanId === undefined) {
+            node.vlanId = endpoint.vlanId;
+        }
+    }
+    /*
+     * Whether a switch that learned this device's MAC on an access port is
+     * thereby its parent. True for anything that hangs off a switch; false
+     * for a core-layer device (router, firewall, load balancer - or a
+     * custom role the project marked core) and for another switch. The
+     * configured flag wins where the project set one; the built-in core set
+     * is the fallback, as everywhere else the stamp is read.
+     */
+    static isLearningSwitchTheParent(deviceNode) {
+        if (!deviceNode) {
+            return true;
+        }
+        const isCore = deviceNode.isCoreLayerRole !== undefined
+            ? deviceNode.isCoreLayerRole
+            : BUILT_IN_CORE_LAYER_ROLES.has(deviceNode.role || "unknown");
+        if (isCore) {
+            return false;
+        }
+        const roleKey = (deviceNode.roleKey || deviceNode.role || "")
+            .trim()
+            .toLowerCase();
+        return roleKey !== "switch";
+    }
     /*
      * Both protocols' neighbor entries, normalized. LLDP first so its
      * (usually richer) identifiers win the first-report slots; CDP then
@@ -777,6 +1252,15 @@ export default class NetworkTopologyUtil {
                 add({ kind: "mac", value: mac });
             }
         }
+        /*
+         * The declared MAC too. A ping-only device has no interface walk to
+         * report its MACs from, so this is the only MAC it can answer to when
+         * a neighbour advertises it as an LLDP chassis id.
+         */
+        const declaredMac = normalizeMac(device.macAddress);
+        if (declaredMac) {
+            add({ kind: "mac", value: declaredMac });
+        }
         return keys;
     }
     /*