@takodotid/circuit 0.18.0 → 0.18.1

package/dist/cli/index.js

@@ -1202,6 +1202,11 @@ var DYNAMIC = new Set([
   "/ip firewall filter",
   "/ipv6 firewall filter",
   "/ip firewall nat",
+  "/ipv6 firewall nat",
+  "/ip firewall mangle",
+  "/ipv6 firewall mangle",
+  "/ip firewall raw",
+  "/ipv6 firewall raw",
   "/ip dhcp-server lease"
 ]);
 var quote = (value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$")}"`;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.18.0",
+    "version": "0.18.1",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",

package/src/adapters/devices/routeros/TRAPS.md

@@ -17,6 +17,7 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - A switch-chip rule's `rate` did not limit traffic the CPU routes. On a CCR2216 on 7.23.5, under a 12 Gbps flood, a rule at `2G` and then at `100M` changed nothing that reached the CPU, while a drop with the same match left 3 Mbps. Drop what you can recognise instead of limiting it.
 - The switch chip reads a UDP fragment after the first as port 0. `src-port=0` drops the rest of a fragmented flood whose first fragments another rule dropped by port; without it they reach the CPU, which holds them waiting for a first fragment that never comes.
 - A switch-chip rule takes one port or a range, `1900-1901`; a list is refused. The render makes one rule for each port in a list.
+- Any rule using fasttrack adds a dynamic "special dummy rule to show fasttrack counters" to the filter and the raw table. It cannot be removed, `cannot remove builtin`, so every selector over those menus skips dynamic entries.
 - The connection table holds 1,048,576 entries on a CCR2216 with 16 GiB, and a full table refuses every new connection through the router, not only the target's. A SYN flood of 210,000 packets a second filled it in five seconds; a UDP flood from random sources fills it about six times faster, because an unanswered UDP entry lives 30 seconds. Traffic in `untracked` prefixes never enters it.
 - With hardware offload on, routed traffic bypasses the forward chain entirely. `hardware_offload: false` on an interface is what makes the firewall apply to it, at the cost of CPU. The only proof of offload is the `H` flag on a route.
 - `/ip cloud ddns-enabled` cannot be turned off on 7.23.5.

package/src/adapters/devices/routeros/plan.ts

@@ -74,6 +74,11 @@ const DYNAMIC = new Set([
     "/ip firewall filter",
     "/ipv6 firewall filter",
     "/ip firewall nat",
+    "/ipv6 firewall nat",
+    "/ip firewall mangle",
+    "/ipv6 firewall mangle",
+    "/ip firewall raw",
+    "/ipv6 firewall raw",
     "/ip dhcp-server lease",
 ]);