@takodotid/circuit 0.25.0 → 0.26.0

package/src/adapters/devices/fortios/render.ts

@@ -0,0 +1,734 @@
+// The neutral model as FortiOS configuration, in the form `show` prints, so the plan can compare the two section by section.
+
+import { familyOf, host, netmask, split } from "../../../core/addr";
+import { marker } from "../../../core/secrets";
+import type { Device, Helper, Severity } from "../../../schema";
+import { portsOf, spell } from "../catalog";
+import { firewall, natRules } from "./firewall";
+import { addressed, addressesOf, holderOf, interfaceFor, nameOf, network, subnet, vrfNumber } from "./names";
+import { routing, usesBfd } from "./routing";
+import { Block, print, quote, quoteAll } from "./tree";
+
+/** Where the pre-login banner's text is kept. */
+export const BANNER = 'system replacemsg admin "pre_admin-disclaimer-text"';
+
+/** Every section Circuit manages, in the order a change goes in: what others name comes first. */
+export const SECTIONS = [
+    "vpn certificate local",
+    "vpn certificate ca",
+    "system global",
+    BANNER,
+    "system settings",
+    "system accprofile",
+    "system admin",
+    "system interface",
+    "system gre-tunnel",
+    "system vxlan",
+    "system dns",
+    "system dns-server",
+    "system ntp",
+    "system snmp sysinfo",
+    "system snmp community",
+    "system snmp user",
+    "log memory setting",
+    "log memory filter",
+    "log disk setting",
+    ...["", "2", "3", "4"].flatMap((number) => [`log syslogd${number} setting`, `log syslogd${number} filter`]),
+    "system sflow",
+    "system netflow",
+    "system dhcp server",
+    "router static",
+    "router static6",
+    "router prefix-list",
+    "router prefix-list6",
+    "router community-list",
+    "router route-map",
+    "router ospf",
+    "router ospf6",
+    "router bgp",
+    "system session-helper",
+    "firewall address",
+    "firewall address6",
+    "firewall addrgrp",
+    "firewall addrgrp6",
+    "firewall service custom",
+    "firewall ippool",
+    "firewall vip",
+    "firewall policy",
+    "firewall policy6",
+    "firewall local-in-policy",
+    "firewall local-in-policy6",
+    "firewall central-snat-map",
+    "firewall acl",
+    "firewall acl6",
+] as const;
+
+export type Section = (typeof SECTIONS)[number];
+
+/** Sections `show` prints without what matters, which `show full-configuration` prints: a certificate's text. */
+export const FULL: readonly string[] = ["vpn certificate local", "vpn certificate ca"];
+
+/** The FortiOS zone number of each IANA zone it has one for. A number names a list of places in one zone; `00` is the device's default. */
+const ZONES: Record<string, readonly string[]> = {
+    "00": ["Pacific/Kwajalein"],
+    "01": ["Pacific/Midway", "Pacific/Pago_Pago"],
+    "02": ["Pacific/Honolulu"],
+    "03": ["America/Anchorage"],
+    "04": ["America/Los_Angeles", "America/Vancouver", "America/Tijuana"],
+    "05": ["America/Phoenix"],
+    "06": ["America/Denver", "America/Edmonton"],
+    "07": ["America/Guatemala", "America/Costa_Rica", "America/El_Salvador", "America/Tegucigalpa", "America/Managua"],
+    "08": ["America/Chicago", "America/Winnipeg"],
+    "09": ["America/Mexico_City"],
+    "10": ["America/Regina"],
+    "11": ["America/Bogota", "America/Lima", "America/Guayaquil"],
+    "12": ["America/New_York", "America/Toronto"],
+    "13": ["America/Indiana/Indianapolis"],
+    "14": ["America/Halifax"],
+    "15": ["America/La_Paz"],
+    "16": ["America/Santiago"],
+    "17": ["America/St_Johns"],
+    "18": ["America/Sao_Paulo"],
+    "19": ["America/Argentina/Buenos_Aires"],
+    "20": ["America/Nuuk", "America/Godthab"],
+    "21": ["Atlantic/South_Georgia"],
+    "22": ["Atlantic/Azores"],
+    "23": ["Atlantic/Cape_Verde"],
+    "24": ["Africa/Monrovia"],
+    "25": ["Europe/London", "Europe/Dublin", "Europe/Lisbon", "Atlantic/Canary"],
+    "26": ["Europe/Amsterdam", "Europe/Berlin", "Europe/Zurich", "Europe/Rome", "Europe/Stockholm", "Europe/Vienna"],
+    "27": ["Europe/Belgrade", "Europe/Bratislava", "Europe/Budapest", "Europe/Ljubljana", "Europe/Prague"],
+    "28": ["Europe/Brussels", "Europe/Copenhagen", "Europe/Madrid", "Europe/Paris"],
+    "29": ["Europe/Sarajevo", "Europe/Skopje", "Europe/Warsaw", "Europe/Zagreb"],
+    "30": ["Africa/Lagos"],
+    "31": ["Europe/Athens", "Europe/Sofia", "Europe/Vilnius"],
+    "32": ["Europe/Bucharest"],
+    "33": ["Africa/Cairo"],
+    "34": ["Africa/Harare", "Africa/Johannesburg"],
+    "35": ["Europe/Helsinki", "Europe/Riga", "Europe/Tallinn"],
+    "36": ["Asia/Jerusalem"],
+    "37": ["Asia/Baghdad"],
+    "38": ["Asia/Kuwait", "Asia/Riyadh"],
+    "39": ["Europe/Volgograd"],
+    "40": ["Africa/Nairobi"],
+    "41": ["Asia/Tehran"],
+    "42": ["Asia/Dubai", "Asia/Muscat"],
+    "43": ["Asia/Baku"],
+    "44": ["Asia/Kabul"],
+    "45": ["Asia/Yekaterinburg"],
+    "46": ["Asia/Karachi", "Asia/Tashkent"],
+    "47": ["Asia/Kolkata", "Asia/Calcutta"],
+    "48": ["Asia/Kathmandu"],
+    "49": ["Asia/Almaty", "Asia/Novosibirsk"],
+    "50": ["Asia/Dhaka"],
+    "51": ["Asia/Colombo"],
+    "52": ["Asia/Yangon", "Asia/Rangoon"],
+    "53": ["Asia/Jakarta", "Asia/Bangkok", "Asia/Ho_Chi_Minh"],
+    "54": ["Asia/Krasnoyarsk"],
+    "55": ["Asia/Shanghai", "Asia/Chongqing", "Asia/Hong_Kong", "Asia/Urumqi", "Asia/Irkutsk"],
+    "56": ["Asia/Ulaanbaatar"],
+    "57": ["Asia/Kuala_Lumpur", "Asia/Singapore"],
+    "58": ["Australia/Perth"],
+    "59": ["Asia/Taipei"],
+    "60": ["Asia/Tokyo", "Asia/Seoul"],
+    "61": ["Asia/Yakutsk"],
+    "62": ["Australia/Adelaide"],
+    "63": ["Australia/Darwin"],
+    "64": ["Australia/Brisbane"],
+    "65": ["Australia/Sydney", "Australia/Melbourne", "Australia/Canberra"],
+    "66": ["Pacific/Guam", "Pacific/Port_Moresby"],
+    "67": ["Australia/Hobart"],
+    "68": ["Asia/Vladivostok"],
+    "69": ["Asia/Magadan"],
+    "70": ["Pacific/Guadalcanal", "Pacific/Noumea"],
+    "71": ["Pacific/Auckland"],
+    "72": ["Pacific/Fiji", "Asia/Kamchatka", "Pacific/Majuro"],
+    "73": ["Pacific/Tongatapu"],
+    "74": ["America/Caracas"],
+    "75": ["America/Montevideo"],
+    "76": ["Pacific/Kiritimati"],
+    "77": ["America/Guyana"],
+    "78": ["Africa/Windhoek"],
+    "79": ["Africa/Casablanca"],
+    "80": ["UTC", "Etc/UTC", "Etc/GMT", "GMT"],
+    "81": ["America/Mazatlan", "America/Chihuahua"],
+    "82": ["Pacific/Chatham"],
+    "83": ["Europe/Moscow"],
+    "84": ["Europe/Minsk"],
+    "85": ["Europe/Istanbul"],
+    "86": ["Pacific/Apia"],
+    "87": ["America/Asuncion"],
+};
+
+/** The zone number for an IANA zone. UTC when the config names none. */
+export function zoneOf(timezone = "UTC"): string | undefined {
+    return Object.entries(ZONES).find(([, places]) => places.includes(timezone))?.[0];
+}
+
+/** What each role may do: the factory profile for an admin, and a profile Circuit adds for the others. */
+export const PROFILE = { admin: "super_admin", operator: "circuit-operator", "read-only": "circuit-read-only" } as const;
+
+/** The permission groups of an access profile. */
+const PERMISSION_GROUPS = [
+    "secfabgrp",
+    "ftviewgrp",
+    "authgrp",
+    "sysgrp",
+    "netgrp",
+    "loggrp",
+    "fwgrp",
+    "vpngrp",
+    "utmgrp",
+    "wanoptgrp",
+    "wifi",
+];
+
+/** The most public keys a user holds. */
+export const SSH_KEYS = 3;
+
+/** The most resolvers the device and a DHCP server hold, per family. */
+export const RESOLVERS = { device: 2, dhcp: 4 } as const;
+
+/** The most syslog collectors the device sends to. */
+export const COLLECTORS = 4;
+
+/** The most VRFs the device holds besides its default table. */
+export const VRFS = 31;
+
+/** A severity as the platform names it. */
+export const LEVEL: Record<Severity, string> = {
+    emergency: "emergency",
+    alert: "alert",
+    critical: "critical",
+    error: "error",
+    warning: "warning",
+    notice: "notification",
+    info: "information",
+    debug: "debug",
+};
+
+/** The helpers the factory runs, by the name a config gives them: protocol and port of each. */
+export const HELPERS: Partial<Record<Helper, readonly [string, number, number][]>> = {
+    ftp: [["ftp", 6, 21]],
+    tftp: [["tftp", 17, 69]],
+    sip: [["sip", 17, 5060]],
+    h323: [
+        ["h323", 6, 1720],
+        ["ras", 17, 1719],
+    ],
+    pptp: [["pptp", 6, 1723]],
+    rtsp: [
+        ["rtsp", 6, 554],
+        ["rtsp", 6, 7070],
+        ["rtsp", 6, 8554],
+    ],
+};
+
+/** Speed by the platform's spelling, for each class a port's cage takes. */
+export const SPEEDS: Record<string, Partial<Record<string, string>>> = {
+    "40g": { "40g": "40000full" },
+    "10g": { "10g": "10000full", "1g": "1000full" },
+    "1g": { "1g": "1000full", "100m": "100full" },
+};
+
+/** The services a port or an interface answers on its addresses: ping always, and every management service the config turns on. */
+function allowAccess(device: Device): string {
+    const management = device.management ?? {};
+    const services = ["ping"];
+
+    if (management.https) services.push("https");
+    if (management.ssh) services.push("ssh");
+    if (management.snmp) services.push("snmp");
+    if (management.http) services.push("http");
+    if (management.telnet) services.push("telnet");
+    if (management.native) services.push("fgfm");
+
+    return services.join(" ");
+}
+
+export function render(device: Device): string {
+    const root = new Block();
+    for (const section of SECTIONS) root.block(section);
+
+    const section = (name: Section) => root.block(name);
+
+    certificates(section("vpn certificate local"), section("vpn certificate ca"), device);
+    global(section("system global"), device);
+    if (device.system?.banner) section(BANNER).set("buffer", quote(device.system.banner));
+    if (natRules(device).length) section("system settings").set("central-nat", "enable");
+    // SIP is otherwise rewritten by its proxy whatever the helpers say; this way only the `sip` helper does.
+    section("system settings").set("default-voip-alg-mode", "kernel-helper-based");
+    if (usesBfd(device)) section("system settings").set("bfd", "enable");
+    users(section("system accprofile"), section("system admin"), device);
+    interfaces(root, device);
+    dns(section("system dns"), section("system dns-server"), device);
+    ntp(section("system ntp"), device);
+    snmp(root, device);
+    logging(root, device);
+    flowExport(root, device);
+    dhcpServers(section("system dhcp server"), device);
+    staticRoutes(section("router static"), section("router static6"), device);
+    routing(root, device);
+    helpers(section("system session-helper"), device);
+    firewall(root, device);
+
+    return print(root);
+}
+
+/** A certificate with its key is the device's own; one without is only trusted. */
+function certificates(local: Block, trusted: Block, device: Device): void {
+    for (const [name, certificate] of Object.entries(device.certificates ?? {})) {
+        const text = quote(certificate.certificate.trim());
+
+        if (certificate.private_key)
+            local
+                .entry(name)
+                .set("private-key", quote(marker(certificate.private_key)))
+                .set("certificate", text);
+        else trusted.entry(name).set("ca", text);
+    }
+}
+
+function global(block: Block, device: Device): void {
+    const management = device.management ?? {};
+
+    block.set("hostname", quote(device.name));
+
+    const zone = zoneOf(device.system?.timezone);
+    if (zone && zone !== "00") block.set("timezone", zone);
+
+    if (management.ssh?.port) block.set("admin-ssh-port", management.ssh.port);
+    if (management.ssh?.auth_timeout) block.set("admin-ssh-grace-time", management.ssh.auth_timeout);
+    if (management.ssh?.weak_crypto) block.set("strong-crypto", "disable");
+    if (management.https?.port) block.set("admin-sport", management.https.port);
+    if (management.https?.certificate) block.set("admin-server-cert", quote(management.https.certificate));
+    if (management.http?.port) block.set("admin-port", management.http.port);
+    if (management.telnet?.port) block.set("admin-telnet-port", management.telnet.port);
+    // The web interface over HTTP otherwise only redirects to HTTPS.
+    if (management.http) block.set("admin-https-redirect", "disable");
+    if (device.system?.banner) block.set("pre-login-banner", "enable");
+
+    if (device.lldp === true) block.set("lldp-transmission", "enable").set("lldp-reception", "enable");
+}
+
+/** Each user, with the profile its role takes. */
+function users(profiles: Block, admins: Block, device: Device): void {
+    const roles = new Set(Object.values(device.users ?? {}).map((user) => user.role));
+
+    // An operator changes everything but the system's own settings, which hold the users; read-only changes nothing.
+    for (const role of ["operator", "read-only"] as const) {
+        if (!roles.has(role)) continue;
+
+        const profile = profiles.entry(PROFILE[role]);
+        for (const group of PERMISSION_GROUPS) profile.set(group, role === "operator" && group !== "sysgrp" ? "read-write" : "read");
+    }
+
+    for (const [name, user] of Object.entries(device.users ?? {})) {
+        const admin = admins.entry(name);
+
+        admin.set("accprofile", quote(PROFILE[user.role]));
+        if (user.description) admin.set("comments", quote(user.description));
+        admin.set("vdom", quote("root"));
+        (user.ssh_keys ?? []).forEach((key, index) => admin.set(`ssh-public-key${index + 1}`, quote(key)));
+        admin.set("password", quote(marker(user.password)));
+    }
+}
+
+/** Ports, then the LAGs they join, VLAN interfaces on them, loopbacks, and the tunnels with their own tables. */
+function interfaces(root: Block, device: Device): void {
+    const block = root.block("system interface");
+    const access = allowAccess(device);
+
+    for (const port of portsOf(device.platform, device.model)) {
+        const settings = device.ports?.[port as keyof typeof device.ports];
+        const entry = block.entry(spell(device.platform, device.model, port));
+
+        entry.set("vdom", quote("root"));
+        entry.set("type", "physical");
+
+        if (!settings) {
+            redirects(entry, device);
+            entry.set("status", "down");
+            continue;
+        }
+
+        if (settings.description) entry.set("description", quote(settings.description));
+
+        const speed = settings.speed && SPEEDS[port.split("-")[0]!]?.[settings.speed];
+        if (speed) entry.set("speed", speed);
+
+        // A port in a LAG has no redirects of its own: `command parse error`.
+        if (settings.lag) continue;
+
+        redirects(entry, device);
+        if (settings.mtu) entry.set("mtu-override", "enable").set("mtu", settings.mtu);
+        routed(entry, device, port, settings, access);
+    }
+
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+        if (iface.type !== "lag") continue;
+
+        const members = Object.entries(device.ports ?? {})
+            .filter(([, port]) => port?.lag === name)
+            .map(([port]) => spell(device.platform, device.model, port));
+
+        const entry = block.entry(name);
+        entry.set("vdom", quote("root"));
+        entry.set("type", "aggregate");
+        if (members.length) entry.set("member", quoteAll(members));
+        if (iface.mode === "static") entry.set("lacp-mode", "static");
+        if (iface.description) entry.set("description", quote(iface.description));
+        if (iface.mtu) entry.set("mtu-override", "enable").set("mtu", iface.mtu);
+        redirects(entry, device);
+        routed(entry, device, name, iface, access);
+    }
+
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+        if (iface.type !== "vlan") continue;
+
+        const parent = vlanParent(device, iface.vlan);
+        const entry = block.entry(name);
+        entry.set("vdom", quote("root"));
+        if (parent) entry.set("interface", quote(nameOf(device, parent)));
+        entry.set("vlanid", device.vlans?.[iface.vlan]?.id ?? 0);
+        if (iface.description) entry.set("description", quote(iface.description));
+        if (iface.mtu) entry.set("mtu-override", "enable").set("mtu", iface.mtu);
+        redirects(entry, device);
+        routed(entry, device, name, iface, access);
+    }
+
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+        if (iface.type !== "loopback") continue;
+
+        const entry = block.entry(name);
+        entry.set("vdom", quote("root"));
+        entry.set("type", "loopback");
+        if (iface.description) entry.set("description", quote(iface.description));
+        redirects(entry, device);
+        routed(entry, device, name, iface, access);
+    }
+
+    // A tunnel's interface is created by its own table, which names the interface it leaves through.
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+        if (iface.type !== "gre" && iface.type !== "vxlan") continue;
+
+        const outgoing = holderOf(device, iface.local);
+        const via = outgoing ? quote(nameOf(device, outgoing)) : '""';
+
+        // Between IPv6 endpoints the family is stated first: the addresses of the other family are not settings until it is.
+        const ipv6 = familyOf(iface.remote) === "ipv6";
+
+        if (iface.type === "gre") {
+            const tunnel = root.block("system gre-tunnel").entry(name).set("interface", via);
+            if (ipv6) tunnel.set("ip-version", 6).set("remote-gw6", iface.remote).set("local-gw6", iface.local);
+            else tunnel.set("remote-gw", iface.remote).set("local-gw", iface.local);
+        } else {
+            const tunnel = root.block("system vxlan").entry(name).set("interface", via).set("vni", iface.vni);
+            if (ipv6) tunnel.set("ip-version", "ipv6-unicast").set("remote-ip6", quote(iface.remote));
+            else tunnel.set("remote-ip", quote(iface.remote));
+            if (iface.port !== undefined && iface.port !== 4789) tunnel.set("dstport", iface.port);
+        }
+
+        const entry = block.entry(name);
+        entry.set("vdom", quote("root"));
+        entry.set("type", iface.type === "gre" ? "tunnel" : "vxlan");
+        entry.set("interface", via);
+        if (iface.type === "vxlan" && iface.mac) entry.set("macaddr", iface.mac.toLowerCase());
+        if (iface.description) entry.set("description", quote(iface.description));
+        if (iface.mtu) entry.set("mtu-override", "enable").set("mtu", iface.mtu);
+        redirects(entry, device);
+        routed(entry, device, name, iface, access);
+    }
+}
+
+/** The platform sends ICMP redirects unless an interface says otherwise; the config sends them only when asked. */
+function redirects(entry: Block, device: Device): void {
+    if (!device.system?.ip?.icmp_redirects) entry.set("icmp-send-redirect", "disable");
+}
+
+/** The one port or LAG that carries a VLAN tagged, which its VLAN interface sits on. `unsupported()` refuses any other case. */
+export function vlanParent(device: Device, vlan: string): string | undefined {
+    const carriers = [
+        ...Object.entries(device.ports ?? {}).filter(([, port]) => !port?.lag && port?.trunk_vlans?.includes(vlan)),
+        ...Object.entries(device.interfaces ?? {}).filter(([, iface]) => iface.type === "lag" && iface.trunk_vlans?.includes(vlan)),
+    ];
+
+    return carriers.length === 1 ? carriers[0]![0] : undefined;
+}
+
+type RoutedSettings = {
+    addresses?: readonly (string | { address: string; peer: string })[];
+    vrrp?: readonly { id: number; address: string; priority?: number; preempt?: boolean; interval?: number }[];
+    lldp?: boolean;
+    vrf?: string;
+    ipv6_ra?: boolean;
+};
+
+/** Addresses and their routing table, the services answered on them, VRRP, DHCP relay, router advertisements, LLDP and flow sampling of a port or an interface. */
+function routed(entry: Block, device: Device, name: string, settings: RoutedSettings, access: string): void {
+    const addresses = addressesOf(settings);
+    const ipv4 = addresses.filter((address) => familyOf(host(address)) === "ipv4");
+    const ipv6 = addresses.filter((address) => familyOf(host(address)) === "ipv6");
+
+    const vrf = vrfNumber(device, settings.vrf);
+    if (vrf) entry.set("vrf", vrf);
+
+    // A tunnel holds an IPv4 address as a host and its peer with the link's mask.
+    const peer = settings.addresses?.find((item): item is { address: string; peer: string } => typeof item !== "string");
+
+    if (peer) {
+        entry.set("ip", `${host(peer.address)} 255.255.255.255`);
+        entry.set("remote-ip", `${peer.peer} ${netmask(split(peer.address).len)}`);
+        entry.set("allowaccess", access);
+    } else if (ipv4.length) {
+        entry.set("ip", subnet(ipv4[0]!));
+        entry.set("allowaccess", access);
+    }
+
+    if (!peer && ipv4.length > 1) {
+        entry.set("secondary-IP", "enable");
+        const secondaries = entry.block("secondaryip");
+        ipv4.slice(1).forEach((address, index) =>
+            secondaries
+                .entry(index + 1)
+                .set("ip", subnet(address))
+                .set("allowaccess", access)
+        );
+    }
+
+    const relays = Object.values(device.dhcp_relay ?? {}).filter((relay) => relay.interface === name);
+    const relayed = relays.flatMap((relay) => relay.servers);
+    const relayed4 = relayed.filter((server) => familyOf(server) === "ipv4");
+    const relayed6 = relayed.filter((server) => familyOf(server) === "ipv6");
+
+    if (ipv6.length || relayed6.length) {
+        const block = entry.block("ipv6");
+
+        if (ipv6.length) {
+            block.set("ip6-address", ipv6[0]!);
+            block.set("ip6-allowaccess", access);
+        }
+
+        if (settings.ipv6_ra) {
+            block.set("ip6-send-adv", "enable");
+            const prefixes = block.block("ip6-prefix-list");
+            for (const address of ipv6) prefixes.entry(network(address), true);
+        }
+
+        if (relayed6.length) block.set("dhcp6-relay-service", "enable").set("dhcp6-relay-ip", relayed6.join(" "));
+
+        if (ipv6.length > 1) {
+            const extra = block.block("ip6-extra-addr");
+            for (const address of ipv6.slice(1)) extra.entry(address, true);
+        }
+    }
+
+    if (settings.vrrp?.length) {
+        const groups = entry.block("vrrp");
+
+        for (const group of settings.vrrp) {
+            const vrrp = groups.entry(group.id).set("vrip", group.address);
+            if (group.priority !== undefined && group.priority !== 100) vrrp.set("priority", group.priority);
+            if (group.interval !== undefined && group.interval !== 1) vrrp.set("adv-interval", group.interval);
+            // The platform preempts unless told not to; the config preempts only when asked.
+            if (!group.preempt) vrrp.set("preempt", "disable");
+        }
+    }
+
+    if (relayed4.length) {
+        entry.set("dhcp-relay-service", "enable");
+        entry.set("dhcp-relay-ip", quoteAll(relayed4));
+    }
+
+    // LLDP follows the device unless a port says otherwise, or the device lists where it runs.
+    const listed = typeof device.lldp === "object" && device.lldp.interfaces.includes(name as never);
+    if (settings.lldp === false) entry.set("lldp-transmission", "disable").set("lldp-reception", "disable");
+    else if (listed || (settings.lldp === true && device.lldp !== true))
+        entry.set("lldp-transmission", "enable").set("lldp-reception", "enable");
+
+    // A tunnel is not sampled: its traffic is, on the interface it leaves through.
+    const flow = device.flow_export;
+    const tunnel = ["gre", "vxlan"].includes(device.interfaces?.[name]?.type ?? "");
+    const sampled = flow && !tunnel && (!flow.interfaces || flow.interfaces.includes(name as never));
+
+    if (sampled && flow.protocol === "sflow") {
+        entry.set("sflow-sampler", "enable");
+        if (flow.sampling !== undefined && flow.sampling !== 2000) entry.set("sample-rate", flow.sampling);
+    }
+
+    if (sampled && flow.protocol === "netflow-v9") entry.set("netflow-sampler", "both");
+}
+
+/** The device's resolvers, and the interfaces it answers DNS queries on when it serves them. */
+function dns(block: Block, servers: Block, device: Device): void {
+    const resolvers = device.system?.dns?.servers ?? [];
+    const ipv4 = resolvers.filter((server) => familyOf(server) === "ipv4");
+    const ipv6 = resolvers.filter((server) => familyOf(server) === "ipv6");
+
+    if (ipv4[0]) block.set("primary", ipv4[0]);
+    if (ipv4[1]) block.set("secondary", ipv4[1]);
+    if (ipv6[0]) block.set("ip6-primary", ipv6[0]);
+    if (ipv6[1]) block.set("ip6-secondary", ipv6[1]);
+
+    // Recursive, the default mode, answers from what the device has resolved itself.
+    if (device.system?.dns?.serve) for (const name of addressed(device)) servers.entry(nameOf(device, name));
+}
+
+/** The servers the device keeps time from, and the interfaces it answers time queries on when it serves them. */
+function ntp(block: Block, device: Device): void {
+    const ntp = device.system?.ntp;
+    const servers = ntp?.servers ?? [];
+
+    if (servers.length) {
+        block.set("ntpsync", "enable");
+        block.set("type", "custom");
+
+        const list = block.block("ntpserver");
+        servers.forEach((server, index) => list.entry(index + 1).set("server", quote(server)));
+    }
+
+    if (ntp?.serve) {
+        block.set("server-mode", "enable");
+        block.set("interface", quoteAll(addressed(device).map((name) => nameOf(device, name))));
+    }
+}
+
+/** SNMP version 2c with one community, guarded by its hosts, and version 3 users. */
+function snmp(root: Block, device: Device): void {
+    const snmp = device.management?.snmp;
+    if (!snmp) return;
+
+    const sysinfo = root.block("system snmp sysinfo");
+    sysinfo.set("status", "enable");
+    if (snmp.contact) sysinfo.set("contact-info", quote(snmp.contact));
+    if (snmp.location) sysinfo.set("location", quote(snmp.location));
+
+    if (snmp.community) {
+        const community = root.block("system snmp community").entry(1);
+        community.set("name", quote(marker(snmp.community)));
+
+        const allow = snmp.allow ?? device.management?.allow ?? [];
+        const ipv4 = allow.filter((prefix) => familyOf(host(prefix)) === "ipv4");
+        const ipv6 = allow.filter((prefix) => familyOf(host(prefix)) === "ipv6");
+        ipv4.forEach((prefix, index) =>
+            community
+                .block("hosts")
+                .entry(index + 1)
+                .set("ip", subnet(network(prefix)))
+        );
+        ipv6.forEach((prefix, index) =>
+            community
+                .block("hosts6")
+                .entry(index + 1)
+                .set("ipv6", network(prefix))
+        );
+
+        // Version 2c only, and no traps: the config has nowhere to send them.
+        community.set("query-v1-status", "disable");
+        if (snmp.port) community.set("query-v2c-port", snmp.port);
+        community.set("trap-v1-status", "disable");
+        community.set("trap-v2c-status", "disable");
+    }
+
+    for (const [name, user] of Object.entries(snmp.users ?? {})) {
+        const entry = root.block("system snmp user").entry(name);
+        entry.set("security-level", "auth-priv");
+        if (snmp.port) entry.set("query-port", snmp.port);
+        // SHA1 and AES128 are the platform's defaults and are not printed.
+        entry.set("auth-pwd", quote(marker(user.auth_password)));
+        if (user.privacy === "des") entry.set("priv-proto", "des");
+        entry.set("priv-pwd", quote(marker(user.privacy_password)));
+    }
+}
+
+/** Logs kept in memory from a level up, none on disk, and up to four syslog collectors, each with the least severe message it takes. */
+function logging(root: Block, device: Device): void {
+    const logging = device.system?.logging;
+
+    // The device prints whether it keeps logs in memory either way, and keeps them unless told not to.
+    root.block("log memory setting").set("status", logging?.local ? "enable" : "disable");
+    if (logging?.local && logging.local.level !== "info") root.block("log memory filter").set("severity", LEVEL[logging.local.level]);
+
+    // The disk keeps logs unless told not to; the config keeps them only in memory.
+    root.block("log disk setting").set("status", "disable");
+
+    (logging?.remote ?? []).slice(0, COLLECTORS).forEach((collector, index) => {
+        const number = index === 0 ? "" : String(index + 1);
+        const setting = root.block(`log syslogd${number} setting`);
+        setting.set("status", "enable");
+        setting.set("server", quote(collector.address));
+        if (collector.port && collector.port !== 514) setting.set("port", collector.port);
+
+        if (collector.level !== "info") root.block(`log syslogd${number} filter`).set("severity", LEVEL[collector.level]);
+    });
+}
+
+/** One collector, and sampling on each interface it observes. */
+function flowExport(root: Block, device: Device): void {
+    const flow = device.flow_export;
+    const collector = flow?.collectors[0];
+    if (!flow || !collector) return;
+
+    if (flow.protocol === "sflow") {
+        const block = root.block("system sflow").set("collector-ip", collector.address);
+        if (collector.port && collector.port !== 6343) block.set("collector-port", collector.port);
+    }
+
+    if (flow.protocol === "netflow-v9") {
+        const block = root.block("system netflow").set("collector-ip", collector.address);
+        if (collector.port && collector.port !== 2055) block.set("collector-port", collector.port);
+    }
+}
+
+function dhcpServers(block: Block, device: Device): void {
+    Object.values(device.dhcp ?? {}).forEach((server, index) => {
+        const entry = block.entry(index + 1);
+        if (server.lease_time !== undefined && server.lease_time !== 604800) entry.set("lease-time", server.lease_time);
+        entry.set("default-gateway", server.gateway);
+        entry.set("netmask", netmask(split(server.network).len));
+        entry.set("interface", quote(nameOf(device, server.interface)));
+        entry.set("dns-service", "specify");
+        entry.block("ip-range").entry(1).set("start-ip", server.pool[0]).set("end-ip", server.pool[1]);
+
+        (server.reservations ?? []).forEach((reservation, number) => {
+            const reserved = entry.block("reserved-address").entry(number + 1);
+            reserved.set("ip", reservation.address).set("mac", reservation.mac.toLowerCase());
+            if (reservation.description) reserved.set("description", quote(reservation.description));
+        });
+
+        (server.dns ?? []).forEach((resolver, number) => entry.set(`dns-server${number + 1}`, resolver));
+    });
+}
+
+/** Each route by its position. A route goes in the routing table of the interface it leaves through. A default route is the platform's default destination and is not printed. */
+function staticRoutes(ipv4: Block, ipv6: Block, device: Device): void {
+    const counters = { ipv4: 0, ipv6: 0 };
+
+    for (const route of device.routing?.static ?? []) {
+        const family = familyOf(split(route.prefix).addr);
+        const entry = (family === "ipv4" ? ipv4 : ipv6).entry(++counters[family]);
+        const prefix = network(route.prefix);
+
+        if (family === "ipv6" && prefix !== "::/0") entry.set("dst", prefix);
+        if (family === "ipv4" && prefix !== "0.0.0.0/0") entry.set("dst", subnet(prefix));
+
+        if (route.via) entry.set("gateway", route.via);
+
+        const outgoing = route.interface ?? (route.via ? interfaceFor(device, route.via, route.vrf) : undefined);
+        if (outgoing && !route.blackhole) entry.set("device", quote(nameOf(device, outgoing)));
+
+        if (route.distance !== undefined && route.distance !== 10) entry.set("distance", route.distance);
+        if (route.description) entry.set("comment", quote(route.description));
+        if (route.blackhole) entry.set("blackhole", "enable");
+    }
+}
+
+/** The helpers the config lists, each on the protocols and ports the factory gives it. None run otherwise. */
+function helpers(block: Block, device: Device): void {
+    let number = 0;
+
+    for (const helper of device.firewall?.helpers ?? []) {
+        for (const [name, protocol, port] of HELPERS[helper] ?? [])
+            block.entry(++number).set("name", name).set("protocol", protocol).set("port", port);
+    }
+}