@takodotid/circuit 0.18.4 → 0.18.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/cli/index.js
CHANGED
|
@@ -1207,7 +1207,8 @@ var DYNAMIC = new Set([
|
|
|
1207
1207
|
"/ipv6 firewall mangle",
|
|
1208
1208
|
"/ip firewall raw",
|
|
1209
1209
|
"/ipv6 firewall raw",
|
|
1210
|
-
"/ip dhcp-server lease"
|
|
1210
|
+
"/ip dhcp-server lease",
|
|
1211
|
+
"/interface bridge vlan"
|
|
1211
1212
|
]);
|
|
1212
1213
|
var quote = (value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$")}"`;
|
|
1213
1214
|
var value = (raw) => /^[\w.:/@,!-]+$/.test(raw) ? raw : quote(raw);
|
package/package.json
CHANGED
|
@@ -15,6 +15,7 @@ Behaviour that looks like something else. Each one has been hit on a real device
|
|
|
15
15
|
- Incoming GRE is subject to the input chain. Accept it before testing the tunnel.
|
|
16
16
|
- A WireGuard peer's name is unique on the device, and a new key under the same name is refused as a new peer, `entry with this name already exists`. The plan finds a peer by name, so a new key is a `set`.
|
|
17
17
|
- `monitor-traffic` on a VLAN interface counts only what the CPU handles, and not consistently: during a flood a VLAN showed 14 Mbps leaving while its physical port sent 0.45 Mbps. Measure on the physical port, `/interface ethernet print stats`, which the switch chip counts.
|
|
18
|
+
- A VLAN interface on the bridge adds a dynamic bridge VLAN entry for its VLAN, "added by vlan on bridge", beside the static one. A selector by `vlan-ids` then finds both, and a `set` on the pair fails with `no such item`. Selectors on bridge VLANs skip dynamic entries.
|
|
18
19
|
- Switch-chip rules have no address lists and no connection state. A drop is an empty `new-dst-ports`.
|
|
19
20
|
- A switch-chip rule's `rate` did not limit traffic the CPU routes. On a CCR2216 on 7.23.5, under a 12 Gbps flood, a rule at `2G` and then at `100M` changed nothing that reached the CPU, while a drop with the same match left 3 Mbps. Drop what you can recognise instead of limiting it.
|
|
20
21
|
- The switch chip reads a UDP fragment after the first as port 0. `src-port=0` drops the rest of a fragmented flood whose first fragments another rule dropped by port; without it they reach the CPU, which holds them waiting for a first fragment that never comes.
|