@takodotid/circuit 0.18.3 → 0.18.5

package/dist/cli/index.js

@@ -792,7 +792,8 @@ async function apply(device, _network, plan) {
     for (const step of plan.steps) {
       for (const line of step.send) {
         let answer = await send(channel, substitute(line), 20000, 2000);
-        if (/[[(]y\/n[\])]|input 'y'/i.test(answer) || CONFIRM.test(line))
+        const asks = /[[(]y\/n[\])]|input 'y'/i.test(answer) || CONFIRM.test(line) && !/set successfully/i.test(answer);
+        if (asks)
           answer += await send(channel, "y", 1e4, 1000);
         if (REFUSED.test(answer))
           throw new Error(`${step.title}: ${line}
@@ -1206,7 +1207,8 @@ var DYNAMIC = new Set([
   "/ipv6 firewall mangle",
   "/ip firewall raw",
   "/ipv6 firewall raw",
-  "/ip dhcp-server lease"
+  "/ip dhcp-server lease",
+  "/interface bridge vlan"
 ]);
 var quote = (value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$")}"`;
 var value = (raw) => /^[\w.:/@,!-]+$/.test(raw) ? raw : quote(raw);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.18.3",
+    "version": "0.18.5",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",

package/src/adapters/devices/raisecom-ros/TRAPS.md

@@ -7,7 +7,7 @@ Behaviour that looks like something else. Each one has been hit on a RAX721 runn
 - `show running-config` stops about halfway with no error unless `terminal page-break disable` is sent first and the read waits several seconds of silence.
 - A `?` sent by a script is executed. Once it applied an address with a /8 mask.
 - An access-list cannot change while any service holds it: `ACL 1000 is in use`. Every holder is released first and bound again after. `no ssh2 access-list` needs the list number.
-- `portswitch`, `switchport trunk allowed vlan` and `switchport mode` ask for `y` and do nothing without it.
+- `portswitch`, `switchport trunk allowed vlan` and `switchport mode` ask for `y` and do nothing without it, except when they need no confirming: `switchport mode trunk` on a port leaving access mode answers `Set successfully` at once, and a `y` sent after it is refused, `Error input`.
 - A VLAN is removed with `no vlan <id>`, not `no create vlan`.
 - The factory account `raisecom` cannot be removed and its service type cannot change. Only its password is ours.
 - Factory SNMP communities survive hardening, and `private` can write. The render removes both.

package/src/adapters/devices/raisecom-ros/index.ts

@@ -479,7 +479,9 @@ export async function apply(device: Device, _network: readonly Device[], plan: P
         for (const step of plan.steps) {
             for (const line of step.send) {
                 let answer = await send(channel, substitute(line), 20_000, 2000);
-                if (/[[(]y\/n[\])]|input 'y'/i.test(answer) || CONFIRM.test(line)) answer += await send(channel, "y", 10_000, 1000);
+                // A confirming line asks for `y` unless the change needs no confirming, when the device sets it at once.
+                const asks = /[[(]y\/n[\])]|input 'y'/i.test(answer) || (CONFIRM.test(line) && !/set successfully/i.test(answer));
+                if (asks) answer += await send(channel, "y", 10_000, 1000);
                 if (REFUSED.test(answer)) throw new Error(`${step.title}: ${line}\n    device said: ${answer.trim().slice(0, 300)}`);
 
                 const release = RELEASE.exec(line);

package/src/adapters/devices/routeros/TRAPS.md

@@ -15,6 +15,7 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - Incoming GRE is subject to the input chain. Accept it before testing the tunnel.
 - A WireGuard peer's name is unique on the device, and a new key under the same name is refused as a new peer, `entry with this name already exists`. The plan finds a peer by name, so a new key is a `set`.
 - `monitor-traffic` on a VLAN interface counts only what the CPU handles, and not consistently: during a flood a VLAN showed 14 Mbps leaving while its physical port sent 0.45 Mbps. Measure on the physical port, `/interface ethernet print stats`, which the switch chip counts.
+- A VLAN interface on the bridge adds a dynamic bridge VLAN entry for its VLAN, "added by vlan on bridge", beside the static one. A selector by `vlan-ids` then finds both, and a `set` on the pair fails with `no such item`. Selectors on bridge VLANs skip dynamic entries.
 - Switch-chip rules have no address lists and no connection state. A drop is an empty `new-dst-ports`.
 - A switch-chip rule's `rate` did not limit traffic the CPU routes. On a CCR2216 on 7.23.5, under a 12 Gbps flood, a rule at `2G` and then at `100M` changed nothing that reached the CPU, while a drop with the same match left 3 Mbps. Drop what you can recognise instead of limiting it.
 - The switch chip reads a UDP fragment after the first as port 0. `src-port=0` drops the rest of a fragmented flood whose first fragments another rule dropped by port; without it they reach the CPU, which holds them waiting for a first fragment that never comes.

package/src/adapters/devices/routeros/plan.ts

@@ -80,6 +80,7 @@ const DYNAMIC = new Set([
     "/ip firewall raw",
     "/ipv6 firewall raw",
     "/ip dhcp-server lease",
+    "/interface bridge vlan",
 ]);
 
 /** Quote a value for a command. */