@takodotid/circuit 0.18.0 → 0.18.2

package/dist/cli/index.js

@@ -1202,6 +1202,11 @@ var DYNAMIC = new Set([
   "/ip firewall filter",
   "/ipv6 firewall filter",
   "/ip firewall nat",
+  "/ipv6 firewall nat",
+  "/ip firewall mangle",
+  "/ipv6 firewall mangle",
+  "/ip firewall raw",
+  "/ipv6 firewall raw",
   "/ip dhcp-server lease"
 ]);
 var quote = (value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$")}"`;
@@ -2274,6 +2279,7 @@ function bgpConnections(out, ctx) {
       connect: settings.passive ? "no" : undefined,
       "hold-time": settings.hold_time ? duration(settings.hold_time) : undefined,
       "input.filter": chainName(settings.import ?? REJECT_ALL, family),
+      instance: "default",
       [`input.limit-process-routes-${family}`]: settings.max_prefixes,
       "keepalive-time": settings.keepalive ? duration(settings.keepalive) : undefined,
       listen: settings.passive ? "yes" : undefined,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.18.0",
+    "version": "0.18.2",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",

package/src/adapters/devices/routeros/TRAPS.md

@@ -7,7 +7,7 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - `[find address=X/Y]` unquoted matches nothing, silently. Every selector the plan builds is quoted.
 - `~` in `find` has no anchors. Match exactly.
 - A property of the same group is printed as a bare suffix, `output.filter-chain=X .network=Y`, which only reads back inside that command. The parser expands it before building a `set`.
-- `/routing bgp connection add` without `local.role` is refused, so the render always states one.
+- `/routing bgp connection add` without `local.role` is refused, so the render always states one. On 7.23 one without `instance` is refused too, `missing value(s) of argument(s) instance`, although the export never prints `instance=default`.
 - A connection without `input.filter` accepts everything. A neighbor without a policy is given `REJECT-ALL`.
 - A session edited repeatedly can stick: SYN both ways, no RST, no log. Remove the connection and add it again.
 - A session that never established is missing from `/routing bgp session print`; look at `/routing bgp connection print`.
@@ -17,6 +17,7 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - A switch-chip rule's `rate` did not limit traffic the CPU routes. On a CCR2216 on 7.23.5, under a 12 Gbps flood, a rule at `2G` and then at `100M` changed nothing that reached the CPU, while a drop with the same match left 3 Mbps. Drop what you can recognise instead of limiting it.
 - The switch chip reads a UDP fragment after the first as port 0. `src-port=0` drops the rest of a fragmented flood whose first fragments another rule dropped by port; without it they reach the CPU, which holds them waiting for a first fragment that never comes.
 - A switch-chip rule takes one port or a range, `1900-1901`; a list is refused. The render makes one rule for each port in a list.
+- Any rule using fasttrack adds a dynamic "special dummy rule to show fasttrack counters" to the filter and the raw table. It cannot be removed, `cannot remove builtin`, so every selector over those menus skips dynamic entries.
 - The connection table holds 1,048,576 entries on a CCR2216 with 16 GiB, and a full table refuses every new connection through the router, not only the target's. A SYN flood of 210,000 packets a second filled it in five seconds; a UDP flood from random sources fills it about six times faster, because an unanswered UDP entry lives 30 seconds. Traffic in `untracked` prefixes never enters it.
 - With hardware offload on, routed traffic bypasses the forward chain entirely. `hardware_offload: false` on an interface is what makes the firewall apply to it, at the cost of CPU. The only proof of offload is the `H` flag on a route.
 - `/ip cloud ddns-enabled` cannot be turned off on 7.23.5.

package/src/adapters/devices/routeros/plan.ts

@@ -74,6 +74,11 @@ const DYNAMIC = new Set([
     "/ip firewall filter",
     "/ipv6 firewall filter",
     "/ip firewall nat",
+    "/ipv6 firewall nat",
+    "/ip firewall mangle",
+    "/ipv6 firewall mangle",
+    "/ip firewall raw",
+    "/ipv6 firewall raw",
     "/ip dhcp-server lease",
 ]);
 

package/src/adapters/devices/routeros/render.ts

@@ -1141,6 +1141,8 @@ function bgpConnections(out: Output, ctx: Context): void {
                 connect: settings.passive ? "no" : undefined,
                 "hold-time": settings.hold_time ? duration(settings.hold_time) : undefined,
                 "input.filter": chainName(settings.import ?? REJECT_ALL, family),
+                // The one instance bgpInstance adds. 7.23 refuses a new connection without it.
+                instance: "default",
                 [`input.limit-process-routes-${family}`]: settings.max_prefixes,
                 "keepalive-time": settings.keepalive ? duration(settings.keepalive) : undefined,
                 listen: settings.passive ? "yes" : undefined,