@takodotid/circuit 0.18.2 → 0.18.4

package/dist/cli/index.js

@@ -792,7 +792,8 @@ async function apply(device, _network, plan) {
     for (const step of plan.steps) {
       for (const line of step.send) {
         let answer = await send(channel, substitute(line), 20000, 2000);
-        if (/[[(]y\/n[\])]|input 'y'/i.test(answer) || CONFIRM.test(line))
+        const asks = /[[(]y\/n[\])]|input 'y'/i.test(answer) || CONFIRM.test(line) && !/set successfully/i.test(answer);
+        if (asks)
           answer += await send(channel, "y", 1e4, 1000);
         if (REFUSED.test(answer))
           throw new Error(`${step.title}: ${line}
@@ -1086,7 +1087,6 @@ function normal(command) {
   return result;
 }
 var IDENTITY = {
-  "/interface wireguard peers": ["public-key"],
   "/interface list member": ["list", "interface"],
   "/ip firewall address-list": ["list", "address"],
   "/ipv6 firewall address-list": ["list", "address"],

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.18.2",
+    "version": "0.18.4",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",

package/src/adapters/devices/raisecom-ros/TRAPS.md

@@ -7,7 +7,7 @@ Behaviour that looks like something else. Each one has been hit on a RAX721 runn
 - `show running-config` stops about halfway with no error unless `terminal page-break disable` is sent first and the read waits several seconds of silence.
 - A `?` sent by a script is executed. Once it applied an address with a /8 mask.
 - An access-list cannot change while any service holds it: `ACL 1000 is in use`. Every holder is released first and bound again after. `no ssh2 access-list` needs the list number.
-- `portswitch`, `switchport trunk allowed vlan` and `switchport mode` ask for `y` and do nothing without it.
+- `portswitch`, `switchport trunk allowed vlan` and `switchport mode` ask for `y` and do nothing without it, except when they need no confirming: `switchport mode trunk` on a port leaving access mode answers `Set successfully` at once, and a `y` sent after it is refused, `Error input`.
 - A VLAN is removed with `no vlan <id>`, not `no create vlan`.
 - The factory account `raisecom` cannot be removed and its service type cannot change. Only its password is ours.
 - Factory SNMP communities survive hardening, and `private` can write. The render removes both.

package/src/adapters/devices/raisecom-ros/index.ts

@@ -479,7 +479,9 @@ export async function apply(device: Device, _network: readonly Device[], plan: P
         for (const step of plan.steps) {
             for (const line of step.send) {
                 let answer = await send(channel, substitute(line), 20_000, 2000);
-                if (/[[(]y\/n[\])]|input 'y'/i.test(answer) || CONFIRM.test(line)) answer += await send(channel, "y", 10_000, 1000);
+                // A confirming line asks for `y` unless the change needs no confirming, when the device sets it at once.
+                const asks = /[[(]y\/n[\])]|input 'y'/i.test(answer) || (CONFIRM.test(line) && !/set successfully/i.test(answer));
+                if (asks) answer += await send(channel, "y", 10_000, 1000);
                 if (REFUSED.test(answer)) throw new Error(`${step.title}: ${line}\n    device said: ${answer.trim().slice(0, 300)}`);
 
                 const release = RELEASE.exec(line);

package/src/adapters/devices/routeros/TRAPS.md

@@ -13,6 +13,8 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - A session that never established is missing from `/routing bgp session print`; look at `/routing bgp connection print`.
 - `tcp-md5-key` set from the CLI has been seen discarded without an error, and a mismatch logs nothing. Confirm with `/tool sniffer quick port=179`.
 - Incoming GRE is subject to the input chain. Accept it before testing the tunnel.
+- A WireGuard peer's name is unique on the device, and a new key under the same name is refused as a new peer, `entry with this name already exists`. The plan finds a peer by name, so a new key is a `set`.
+- `monitor-traffic` on a VLAN interface counts only what the CPU handles, and not consistently: during a flood a VLAN showed 14 Mbps leaving while its physical port sent 0.45 Mbps. Measure on the physical port, `/interface ethernet print stats`, which the switch chip counts.
 - Switch-chip rules have no address lists and no connection state. A drop is an empty `new-dst-ports`.
 - A switch-chip rule's `rate` did not limit traffic the CPU routes. On a CCR2216 on 7.23.5, under a 12 Gbps flood, a rule at `2G` and then at `100M` changed nothing that reached the CPU, while a drop with the same match left 3 Mbps. Drop what you can recognise instead of limiting it.
 - The switch chip reads a UDP fragment after the first as port 0. `src-port=0` drops the rest of a fragmented flood whose first fragments another rule dropped by port; without it they reach the CPU, which holds them waiting for a first fragment that never comes.

package/src/adapters/devices/routeros/export.ts

@@ -254,7 +254,6 @@ export function normal(command: Command): Record<string, string> {
 
 /** Properties that tell two `add` entries of a menu apart. `name` where the menu is not listed. */
 const IDENTITY: Record<string, string[]> = {
-    "/interface wireguard peers": ["public-key"],
     "/interface list member": ["list", "interface"],
     "/ip firewall address-list": ["list", "address"],
     "/ipv6 firewall address-list": ["list", "address"],