@takodotid/circuit 0.25.0 → 0.26.1

package/src/adapters/devices/fortios/routing.ts

@@ -0,0 +1,444 @@
+// OSPF, OSPFv3 and BGP, with the route maps, prefix lists and community lists BGP's policies become.
+
+import { familyOf, host, split } from "../../../core/addr";
+import { marker } from "../../../core/secrets";
+import type { Device, Family, Neighbor, NeighborSettings, PolicyRule } from "../../../schema";
+import { addressesOf, familyOfPrefix, holderOf, nameOf, network, settingsOf, subnet } from "./names";
+import { Block, quote, quoteAll, UNSET } from "./tree";
+
+type AnyRule = PolicyRule<string, string>;
+type AnyNeighbor = Neighbor<string, string>;
+
+/** The route map a session takes when its config states none, so it learns or announces nothing. */
+export const REJECT_ALL = "circuit-reject-all";
+
+/** The start of the comment on a prefix list `refresh` fills. The plan keeps the entries the device holds in one. */
+export const FILLED = "Filled by circuit refresh";
+
+/** The table a prefix list of one family sits in. */
+export const PREFIX_LIST = { ipv4: "router prefix-list", ipv6: "router prefix-list6" } as const;
+
+/** The longest prefix of each family. */
+export const BITS = { ipv4: 32, ipv6: 128 } as const;
+
+/** A neighbor's settings with its group's beneath them. */
+export function neighborSettings(device: Device, neighbor: AnyNeighbor): NeighborSettings<string> {
+    const group = neighbor.group ? device.routing?.bgp?.groups?.[neighbor.group] : undefined;
+    return { ...group, ...neighbor };
+}
+
+/** The families a session carries: its own, or the family of its address. */
+export function familiesOfNeighbor(device: Device, neighbor: AnyNeighbor): Family[] {
+    return [...(neighborSettings(device, neighbor).families ?? [familyOf(neighbor.address)])];
+}
+
+/** Whether OSPF or BGP detects a dead neighbor with BFD, which the device then runs. */
+export function usesBfd(device: Device): boolean {
+    const areas = Object.values(device.routing?.ospf?.areas ?? {});
+    const ospf = areas.some((area) => Object.values(area.interfaces).some((settings) => settings?.bfd));
+    const bgp = Object.values(device.routing?.bgp?.neighbors ?? {}).some((neighbor) => neighborSettings(device, neighbor).bfd);
+    return ospf || bgp;
+}
+
+export function routing(root: Block, device: Device): void {
+    prefixLists(root, device);
+    ospf(root, device);
+    ospf6(root, device);
+    bgp(root, device);
+}
+
+/** A prefix as the platform writes it in a prefix list of its family. */
+const listPrefix = (prefix: string, family: Family) => (family === "ipv4" ? subnet(network(prefix)) : network(prefix));
+
+/** One rule of a prefix list: a prefix, and the lengths it takes within it. The device prints a bound the rule does not hold as `unset`. */
+function listRule(rule: Block, family: Family, prefix: string, lengths: { ge?: number; le?: number } = {}): void {
+    rule.set(family === "ipv4" ? "prefix" : "prefix6", listPrefix(prefix, family));
+    rule.set("ge", lengths.ge ?? UNSET);
+    rule.set("le", lengths.le ?? UNSET);
+}
+
+/** The lengths a rule takes within a prefix to match lengths from `min` to `max`, or none when no length fits. A bound equal to the prefix's own length is left out. */
+function bounds(prefix: string, family: Family, min = 0, max: number = BITS[family]): { ge?: number; le?: number } | undefined {
+    const own = split(network(prefix)).len;
+    const low = Math.max(min, own);
+    if (max < low) return undefined;
+    if (low === own && max === own) return {};
+
+    return { ...(low > own ? { ge: low } : {}), le: max };
+}
+
+/** Each prefix set as a prefix list matching its prefixes and any more specific. One a registry fills starts with a rule that denies every prefix, so it matches nothing until `refresh` fills it. */
+function prefixLists(root: Block, device: Device): void {
+    for (const [name, set] of Object.entries(device.prefix_sets ?? {})) {
+        if ("source" in set) {
+            const { registry, query, family } = set.source;
+            const entry = root
+                .block(PREFIX_LIST[family])
+                .entry(name)
+                .set("comments", quote(`${FILLED} from ${registry} ${query}`));
+            // Until `refresh` fills it, the list refuses every prefix, so a rule matching it matches nothing.
+            const rule = entry.block("rule").entry(1);
+            listRule(rule, family, family === "ipv4" ? "0.0.0.0/0" : "::/0", { le: BITS[family] });
+            rule.set("action", "deny");
+            continue;
+        }
+
+        const family = set.prefixes[0] ? familyOfPrefix(set.prefixes[0]) : "ipv4";
+        const entry = root.block(PREFIX_LIST[family]).entry(name);
+        set.prefixes.forEach((prefix, index) => listRule(entry.block("rule").entry(index + 1), family, prefix, bounds(prefix, family)));
+    }
+}
+
+/** The networks of an interface's addresses of one family, for an OSPF area to announce. */
+function networksOf(device: Device, name: string, family: Family): string[] {
+    return addressesOf(settingsOf(device, name))
+        .filter((address) => familyOfPrefix(address) === family)
+        .map(network);
+}
+
+/** OSPF for IPv4. An area runs on the networks of its interfaces; an interface named with a cost, a link type or BFD has settings of its own; a passive one forms no adjacency. */
+function ospf(root: Block, device: Device): void {
+    const ospf = device.routing?.ospf;
+    if (!ospf || !(ospf.families ?? ["ipv4"]).includes("ipv4")) return;
+
+    const block = root.block("router ospf");
+    if (device.routing?.router_id) block.set("router-id", device.routing.router_id);
+
+    const passive: string[] = [];
+    let networks = 0;
+
+    for (const [areaId, area] of Object.entries(ospf.areas)) {
+        block.block("area").entry(areaId, true);
+
+        for (const [name, settings] of Object.entries(area.interfaces)) {
+            const iface = nameOf(device, name);
+            if (settings?.passive) passive.push(iface);
+
+            if (settings?.cost !== undefined || settings?.network === "point-to-point" || settings?.bfd) {
+                const entry = block.block("ospf-interface").entry(iface);
+                entry.set("interface", quote(iface));
+                if (settings.cost !== undefined) entry.set("cost", settings.cost);
+                if (settings.network === "point-to-point") entry.set("network-type", "point-to-point");
+                if (settings.bfd) entry.set("bfd", "enable");
+            }
+
+            for (const prefix of networksOf(device, name, "ipv4")) {
+                const entry = block.block("network").entry(++networks);
+                entry.set("prefix", subnet(prefix));
+                // The backbone is the platform's default area and is not printed.
+                if (areaId !== "0.0.0.0") entry.set("area", areaId);
+            }
+        }
+    }
+
+    if (passive.length) block.set("passive-interface", quoteAll(passive));
+    for (const source of ospf.redistribute ?? []) block.block(`redistribute "${source}"`).set("status", "enable");
+}
+
+/** OSPFv3 for IPv6. Every interface of an area runs it in that area. */
+function ospf6(root: Block, device: Device): void {
+    const ospf = device.routing?.ospf;
+    if (!ospf?.families?.includes("ipv6")) return;
+
+    const block = root.block("router ospf6");
+    if (device.routing?.router_id) block.set("router-id", device.routing.router_id);
+
+    const passive: string[] = [];
+
+    for (const [areaId, area] of Object.entries(ospf.areas)) {
+        block.block("area").entry(areaId, true);
+
+        for (const [name, settings] of Object.entries(area.interfaces)) {
+            const iface = nameOf(device, name);
+            if (settings?.passive) passive.push(iface);
+
+            const entry = block.block("ospf6-interface").entry(iface);
+            entry.set("interface", quote(iface));
+            if (areaId !== "0.0.0.0") entry.set("area-id", areaId);
+            if (settings?.cost !== undefined) entry.set("cost", settings.cost);
+            if (settings?.network === "point-to-point") entry.set("network-type", "point-to-point");
+            if (settings?.bfd) entry.set("bfd", "enable");
+        }
+    }
+
+    if (passive.length) block.set("passive-interface", quoteAll(passive));
+    for (const source of ospf.redistribute ?? []) block.block(`redistribute "${source}"`).set("status", "enable");
+}
+
+/** BGP: each session with its settings and group's, the route maps its policies become for each family it carries, and the prefixes the device originates. */
+function bgp(root: Block, device: Device): void {
+    const bgp = device.routing?.bgp;
+    if (!bgp) return;
+
+    const block = root.block("router bgp");
+    block.set("as", bgp.asn);
+    if (device.routing?.router_id) block.set("router-id", device.routing.router_id);
+
+    const maps = new RouteMaps(root, device);
+
+    for (const neighbor of Object.values(bgp.neighbors ?? {})) {
+        const settings = neighborSettings(device, neighbor);
+        const families = familiesOfNeighbor(device, neighbor);
+        const entry = block.block("neighbor").entry(neighbor.address);
+
+        // Both families are active unless told otherwise.
+        if (!families.includes("ipv4")) entry.set("activate", "disable");
+        if (!families.includes("ipv6")) entry.set("activate6", "disable");
+        if (settings.bfd) entry.set("bfd", "enable");
+        if (settings.multihop) entry.set("ebgp-enforce-multihop", "enable");
+        if (settings.passive) entry.set("passive", "enable");
+        if (settings.description) entry.set("description", quote(settings.description));
+        if (settings.remote_as !== undefined) entry.set("remote-as", settings.remote_as);
+
+        for (const family of families) {
+            const suffix = family === "ipv4" ? "" : "6";
+            if (settings.max_prefixes !== undefined) entry.set(`maximum-prefix${suffix}`, settings.max_prefixes);
+            entry.set(`route-map-in${suffix}`, quote(maps.of(settings.import, family)));
+            entry.set(`route-map-out${suffix}`, quote(maps.of(settings.export, family)));
+        }
+
+        if (settings.keepalive !== undefined) entry.set("keep-alive-timer", settings.keepalive);
+        if (settings.hold_time !== undefined) entry.set("holdtime-timer", settings.hold_time);
+
+        const source = settings.local_address ? holderOf(device, settings.local_address) : undefined;
+        if (source) entry.set("update-source", quote(nameOf(device, source)));
+
+        if (settings.password) entry.set("password", quote(marker(settings.password)));
+    }
+
+    const networks = { ipv4: 0, ipv6: 0 };
+
+    for (const prefix of bgp.networks ?? []) {
+        const family = familyOfPrefix(prefix);
+        const entry = block.block(family === "ipv4" ? "network" : "network6").entry(++networks[family]);
+        entry.set(family === "ipv4" ? "prefix" : "prefix6", listPrefix(prefix, family));
+    }
+}
+
+/** The family a rule is limited to, by its match: a family, a prefix, or a prefix set of one family. */
+export function familyOfRule(device: Device, rule: AnyRule): Family | undefined {
+    const match = rule.match;
+    if (match?.family) return match.family;
+    if (match?.prefix) return familyOfPrefix(match.prefix);
+
+    const set = match?.prefix_set ? device.prefix_sets?.[match.prefix_set] : undefined;
+    if (set && "source" in set) return set.source.family;
+    if (set?.prefixes[0]) return familyOfPrefix(set.prefixes[0]);
+
+    return undefined;
+}
+
+/** A policy's rules with each call replaced by the rules it calls, in order. A called policy that decides nothing hands back to the caller. */
+export function flatten(device: Device, policy: string, seen: string[] = [policy]): AnyRule[] {
+    const flat: AnyRule[] = [];
+
+    for (const rule of device.policies?.[policy] ?? []) {
+        if (rule.call && !seen.includes(rule.call)) flat.push(...flatten(device, rule.call, [...seen, rule.call]));
+        if (rule.match || rule.set || rule.action) flat.push(rule);
+    }
+
+    return flat;
+}
+
+/** A name made of a value's words, for a list named after what it matches: `64500:*` becomes `64500-any`. */
+const slug = (value: string) => value.replace(/\*/g, "any").replace(/[^A-Za-z0-9]+/g, "-");
+
+/** A community pattern as a regular expression, `*` standing for any value of its field. */
+const patternOf = (pattern: string) => `^${pattern.replace(/\*/g, "[0-9]+")}$`;
+
+/** Each policy as a route map for each family, built once, with the lists its rules match. */
+class RouteMaps {
+    private readonly built = new Set<string>();
+
+    constructor(
+        private readonly root: Block,
+        private readonly device: Device
+    ) {}
+
+    /** The route map for a policy in one family; one that rejects everything when there is no policy. */
+    of(policy: string | undefined, family: Family): string {
+        if (!policy) {
+            if (!this.built.has(REJECT_ALL)) {
+                this.built.add(REJECT_ALL);
+                this.root.block("router route-map").entry(REJECT_ALL).block("rule").entry(1).set("action", "deny");
+            }
+
+            return REJECT_ALL;
+        }
+
+        const name = family === "ipv4" ? policy : `${policy}-v6`;
+        if (this.built.has(name)) return name;
+        this.built.add(name);
+
+        const map = this.root.block("router route-map").entry(name);
+        let number = 0;
+
+        for (const rule of flatten(this.device, policy)) {
+            const only = familyOfRule(this.device, rule);
+            if (only && only !== family) continue;
+
+            this.rule(map.block("rule").entry(++number), rule, family, `${name}-${number}`);
+        }
+
+        return name;
+    }
+
+    private rule(entry: Block, rule: AnyRule, family: Family, label: string): void {
+        const match = rule.match ?? {};
+        const set = rule.set ?? {};
+        const address = family === "ipv4" ? "match-ip-address" : "match-ip6-address";
+
+        if (match.prefix) {
+            this.list(label, family, [[match.prefix, {}]]);
+            entry.set(address, quote(label));
+        } else if (match.prefix_set && match.prefix_length) {
+            const name = `${match.prefix_set}-${match.prefix_length.min ?? 0}-${match.prefix_length.max ?? BITS[family]}`;
+            const prefixes = this.prefixesOf(match.prefix_set);
+            this.list(
+                name,
+                family,
+                prefixes.map((prefix) => [prefix, bounds(prefix, family, match.prefix_length?.min, match.prefix_length?.max)])
+            );
+            entry.set(address, quote(name));
+        } else if (match.prefix_set) {
+            entry.set(address, quote(match.prefix_set));
+        } else if (match.prefix_length) {
+            const { min = 0, max = BITS[family] } = match.prefix_length;
+            const name = `circuit-length-${min}-${max}`;
+            const everything = family === "ipv4" ? "0.0.0.0/0" : "::/0";
+            this.list(name, family, [[everything, bounds(everything, family, min, max)]]);
+            entry.set(address, quote(name));
+        }
+
+        if (match.community)
+            entry.set("match-community", quote(this.communities(`circuit-match-${slug(match.community)}`, [match.community], false)));
+
+        if (set.local_pref !== undefined) entry.set("set-local-preference", set.local_pref);
+        if (set.med !== undefined) entry.set("set-metric", set.med);
+        if (set.prepend !== undefined) entry.set("set-aspath", quote(Array(set.prepend).fill(this.device.routing!.bgp!.asn).join(" ")));
+
+        // Replacing the communities makes removing some needless; added ones join the new ones.
+        if (set.communities) {
+            entry.set("set-community", quoteAll([...set.communities, ...(set.add_communities ?? [])]));
+        } else {
+            if (set.add_communities) entry.set("set-community", quoteAll(set.add_communities)).set("set-community-additive", "enable");
+
+            if (set.remove_communities) {
+                const name = `circuit-remove-${slug(set.remove_communities.join(" "))}`;
+                entry.set("set-community-delete", quote(this.communities(name, set.remove_communities, true)));
+            }
+        }
+
+        if (set.next_hop && familyOf(set.next_hop) === family)
+            entry.set(family === "ipv4" ? "set-ip-nexthop" : "set-ip6-nexthop", set.next_hop);
+
+        // Permit is the default and is not printed.
+        if (rule.action === "reject") entry.set("action", "deny");
+    }
+
+    /** The prefixes of a set the config lists. */
+    private prefixesOf(set: string): string[] {
+        const prefixes = this.device.prefix_sets?.[set];
+        return prefixes && "prefixes" in prefixes ? [...prefixes.prefixes] : [];
+    }
+
+    /** A prefix list of its own, rule by rule; a prefix no length fits is left out. */
+    private list(name: string, family: Family, rules: [string, { ge?: number; le?: number } | undefined][]): void {
+        const rulesBlock = this.root.block(PREFIX_LIST[family]).entry(name).block("rule");
+        let number = 0;
+
+        for (const [prefix, lengths] of rules) if (lengths) listRule(rulesBlock.entry(++number), family, prefix, lengths);
+    }
+
+    /** A community list matching these communities, or, expanded, these patterns. */
+    private communities(name: string, values: readonly string[], patterns: boolean): string {
+        const list = this.root.block("router community-list").entry(name);
+        if (patterns) list.set("type", "expanded");
+
+        values.forEach((value, index) => {
+            const rule = list
+                .block("rule")
+                .entry(index + 1)
+                .set("action", "permit");
+            if (patterns) rule.set("regexp", quote(patternOf(value)));
+            else rule.set("match", quote(value));
+        });
+
+        return name;
+    }
+}
+
+/** Routing the platform cannot express, or that this adapter does not yet write. */
+export function routingGaps(device: Device): string[] {
+    const found: string[] = [];
+    const routing = device.routing;
+
+    if (routing?.rpki) found.push("routing.rpki, the platform has no route origin validation");
+    if (routing?.router_id && !routing.ospf && !routing.bgp) found.push("routing.router_id without OSPF or BGP, which each hold it");
+
+    const ospf = routing?.ospf;
+    if (ospf?.families?.includes("ipv6") && !routing?.router_id) found.push("routing.ospf for IPv6 without routing.router_id");
+
+    for (const area of Object.values(ospf?.areas ?? {})) {
+        for (const name of Object.keys(area.interfaces)) {
+            if (settingsOf(device, name)?.vrf) found.push(`routing.ospf on ${name}, which routes in a VRF: OSPF runs in the default table`);
+
+            const ipv4 = addressesOf(settingsOf(device, name)).some((address) => familyOf(host(address)) === "ipv4");
+            if ((ospf?.families ?? ["ipv4"]).includes("ipv4") && !ipv4)
+                found.push(`routing.ospf on ${name}, which has no IPv4 address for OSPF to run on`);
+        }
+    }
+
+    for (const [name, neighbor] of Object.entries(routing?.bgp?.neighbors ?? {})) {
+        const where = `routing.bgp.neighbors.${name}`;
+        const settings = neighborSettings(device, neighbor);
+
+        if (settings.role) found.push(`${where}.role, the platform has no BGP roles`);
+        if (settings.local_address && !holderOf(device, settings.local_address)) {
+            found.push(`${where}.local_address, no interface holds ${settings.local_address}`);
+        }
+
+        if (familyOf(neighbor.address) === "ipv6" && familiesOfNeighbor(device, neighbor).includes("ipv4")) {
+            found.push(`${where}.families ipv4 over an IPv6 session`);
+        }
+    }
+
+    for (const [name, rules] of Object.entries(device.policies ?? {})) {
+        rules.forEach((rule, index) => found.push(...ruleGaps(device, `policies.${name}[${index}]`, rule)));
+    }
+
+    return found;
+}
+
+function ruleGaps(device: Device, where: string, rule: AnyRule): string[] {
+    const found: string[] = [];
+    const match = rule.match ?? {};
+    const set = rule.set ?? {};
+
+    if ((rule.match || rule.set) && !rule.action)
+        found.push(`${where}, a rule without action: the platform stops at the first rule that matches`);
+
+    for (const field of ["as_path_length", "rpki", "large_community"] as const) {
+        if (match[field] !== undefined) found.push(`${where}.match.${field}`);
+    }
+
+    for (const field of [
+        "large_communities",
+        "add_large_communities",
+        "remove_large_communities",
+        "preferred_source",
+        "blackhole",
+    ] as const) {
+        if (set[field] !== undefined) found.push(`${where}.set.${field}`);
+    }
+
+    if (match.prefix && match.prefix_length) found.push(`${where}.match.prefix with prefix_length`);
+    if (match.prefix && match.prefix_set) found.push(`${where}.match.prefix with prefix_set`);
+
+    const prefixSet = match.prefix_set ? device.prefix_sets?.[match.prefix_set] : undefined;
+    if (prefixSet && "source" in prefixSet && match.prefix_length) {
+        found.push(`${where}.match.prefix_length with a prefix set a registry fills`);
+    }
+
+    return found;
+}

package/src/adapters/devices/fortios/tree.ts

@@ -0,0 +1,121 @@
+// FortiOS configuration as a tree. A `config` block holds settings, nested blocks and, in a table, entries opened with `edit`. The render builds a tree and prints it in the form `show` prints, and the read parses what `show` printed, so the plan compares two trees.
+
+/** A setting the device prints as `unset <key>`, a key it holds empty on purpose, such as an ICMP service's type. */
+export const UNSET = "\u0000unset";
+
+/** One `edit` of a table: its name as written, and what it holds. */
+export type Entry = { id: string; block: Block };
+
+export class Block {
+    readonly settings = new Map<string, string>();
+    readonly blocks = new Map<string, Block>();
+    readonly entries = new Map<string, Entry>();
+
+    /** Set a key. A value of several words is written as given. */
+    set(key: string, value: string | number): this {
+        this.settings.set(key, String(value));
+        return this;
+    }
+
+    /** The nested `config` block with this header, created when absent. */
+    block(header: string): Block {
+        if (!this.blocks.has(header)) this.blocks.set(header, new Block());
+        return this.blocks.get(header)!;
+    }
+
+    /** The table entry with this name, created when absent. A name is quoted unless it is a number, or the table prints it bare, such as an OSPF area or an IPv6 prefix. */
+    entry(id: string | number, plain = false): Block {
+        const written = typeof id === "number" || plain ? String(id) : quote(id);
+        const key = bare(written);
+        if (!this.entries.has(key)) this.entries.set(key, { id: written, block: new Block() });
+        return this.entries.get(key)!.block;
+    }
+
+    isEmpty(): boolean {
+        return !this.settings.size && !this.blocks.size && !this.entries.size;
+    }
+}
+
+/** A string as the CLI takes it, in double quotes. */
+export function quote(text: string): string {
+    return `"${text.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+
+/** Each of several strings quoted, as a list setting takes them. */
+export const quoteAll = (texts: readonly string[]) => texts.map(quote).join(" ");
+
+/** A value's words; a quoted string is one word with its quotes. */
+export function wordsOf(value: string): string[] {
+    return value.match(/"(?:[^"\\]|\\.)*"|'[^']*'|\S+/g) ?? [];
+}
+
+/** A word as the device means it, without quotes or escapes. */
+export function bare(word: string): string {
+    if (word.startsWith('"')) return word.slice(1, -1).replace(/\\(.)/g, "$1");
+    if (word.startsWith("'")) return word.slice(1, -1);
+    return word;
+}
+
+/** The lines that build a block, at an indent, in the form `show` prints and the CLI takes. */
+export function linesOf(block: Block, indent = ""): string[] {
+    const lines: string[] = [];
+
+    for (const [key, value] of block.settings) lines.push(value === UNSET ? `${indent}unset ${key}` : `${indent}set ${key} ${value}`);
+
+    for (const [header, child] of block.blocks) lines.push(`${indent}config ${header}`, ...linesOf(child, indent + "    "), `${indent}end`);
+
+    for (const { id, block: entry } of block.entries.values()) {
+        lines.push(`${indent}edit ${id}`, ...linesOf(entry, indent + "    "), `${indent}next`);
+    }
+
+    return lines;
+}
+
+/** The whole configuration: each top-level block as `config <section>` to `end`. */
+export function print(root: Block): string {
+    const lines: string[] = [];
+    for (const [section, block] of root.blocks) lines.push(`config ${section}`, ...linesOf(block, "    "), "end");
+    return lines.join("\n") + "\n";
+}
+
+/** Whether a line opens a quoted value it does not close, so the value goes on over the next lines. */
+const unclosed = (line: string) => (line.replace(/\\./g, "").match(/"/g)?.length ?? 0) % 2 === 1;
+
+/** The tree of what `show` printed. Lines that are not configuration, such as the version header, are skipped. */
+export function parse(text: string): Block {
+    const root = new Block();
+    const stack: { block: Block; isEntry: boolean }[] = [{ block: root, isEntry: false }];
+    const lines = text.replace(/\r/g, "").split("\n");
+
+    for (let index = 0; index < lines.length; index++) {
+        let line = lines[index]!.trim();
+        if (!line || line.startsWith("#")) continue;
+
+        while (unclosed(line) && index + 1 < lines.length) line += "\n" + lines[++index];
+
+        const current = stack.at(-1)!.block;
+        const [verb] = line.split(/\s+/, 1);
+        const rest = line.slice(verb!.length).trim();
+
+        if (verb === "config") {
+            const child = current.block(rest);
+            stack.push({ block: child, isEntry: false });
+        } else if (verb === "edit") {
+            const key = bare(rest);
+            if (!current.entries.has(key)) current.entries.set(key, { id: rest, block: new Block() });
+            stack.push({ block: current.entries.get(key)!.block, isEntry: true });
+        } else if (verb === "next") {
+            if (stack.at(-1)!.isEntry) stack.pop();
+        } else if (verb === "end") {
+            if (stack.at(-1)!.isEntry) stack.pop();
+            if (stack.length > 1) stack.pop();
+        } else if (verb === "set") {
+            const [key] = rest.split(/\s+/, 1);
+            current.settings.set(key!, rest.slice(key!.length).trim());
+        } else if (verb === "unset") {
+            current.settings.set(rest, UNSET);
+        }
+    }
+
+    return root;
+}

package/src/adapters/devices/index.ts

@@ -1,3 +1,4 @@
+import { fortios } from "./fortios";
 import { junos } from "./junos";
 import { raisecom } from "./raisecom-ros";
 import { routeros } from "./routeros";
@@ -5,4 +6,4 @@ import type { DeviceAdapter } from "./types";
 import { vrp } from "./vrp";
 
 /** Every platform the framework can render and apply, by name. */
-export const adapters: Record<string, DeviceAdapter> = { routeros, vrp, "raisecom-ros": raisecom, junos };
+export const adapters: Record<string, DeviceAdapter> = { routeros, vrp, "raisecom-ros": raisecom, junos, fortios };

package/src/adapters/devices/junos/TRAPS.md

@@ -17,10 +17,10 @@ Behaviour that looks like something else. Each one has been hit on a QFX5100-48S
 - An SNMP community prints in clear, and its value is also its name, so a new value is a second community. A new value is sent after the old communities are deleted, each by its name, which Circuit looks up during the apply and never prints.
 - A firewall filter name is unique across families. The filter guarding the device's services is `circuit-services` for IPv4 and `circuit-services-v6` for IPv6.
 - A VLAN interface's MTU above what its ports carry commits with only a warning, `mtu 9000 is bigger than member link`.
-- There is no `protocols stp`. Plain STP is RSTP held back with `force-version stp`.
+- There is no `protocols stp`. Plain STP is RSTP limited with `force-version stp`.
 - sFlow interfaces print with their unit, `xe-0/0/0.0`.
 - The factory VLAN `default` can be deleted.
-- BGP without a licence commits with only a warning, `requires 'bgp' license`, and sessions establish. The same holds for the other licensed features.
+- BGP without a licence commits with only a warning, `requires 'bgp' license`, and sessions establish. The same is true for the other licensed features.
 - Junos accepts and announces every route over eBGP unless a policy says otherwise: `Default eBGP mode: advertise - accept, receive - accept`. A session without a policy is given `circuit-reject-all`.
 - An export policy sees every active route, not only BGP's. Every export starts with `circuit-bgp-origin`, which passes on BGP's routes and the prefixes in `routing.bgp.networks` and rejects the rest.
 - A policy's or a filter's terms are kept in order, and `set` adds a new term at the end. A change to one rewrites it whole.

package/src/adapters/devices/raisecom-ros/TRAPS.md

@@ -6,7 +6,7 @@ Behaviour that looks like something else. Each one has been hit on a RAX721 runn
 - The SSH server offers only an `ssh-rsa` host key. The adapter allows it for this platform alone; key exchange, cipher and MAC still negotiate modern ones.
 - `show running-config` stops about halfway with no error unless `terminal page-break disable` is sent first and the read waits several seconds of silence.
 - A `?` sent by a script is executed. Once it applied an address with a /8 mask.
-- An access-list cannot change while any service holds it: `ACL 1000 is in use`. Every holder is released first and bound again after. `no ssh2 access-list` needs the list number.
+- An access-list cannot change while any service uses it: `ACL 1000 is in use`. Every service that uses it is unbound first and bound again after. `no ssh2 access-list` needs the list number.
 - `portswitch`, `switchport trunk allowed vlan` and `switchport mode` ask for `y` and do nothing without it, except when they need no confirming: `switchport mode trunk` on a port leaving access mode answers `Set successfully` at once, and a `y` sent after it is refused, `Error input`.
 - A VLAN is removed with `no vlan <id>`, not `no create vlan`.
 - The factory account `raisecom` cannot be removed and its service type cannot change. Only its password is ours.
@@ -18,5 +18,5 @@ Behaviour that looks like something else. Each one has been hit on a RAX721 runn
 - An SNMPv3 user prints as localized keys, `authkey sha <hex> privkey  aes128 <hex>`, which authenticate as well as the passphrase. The read redacts them. An access group prints a `notify internet` it was not given. A user's group is removed with `no snmp-server group user <user> usm`.
 - A VRRP group is enabled once it has an address and preempts unless `no vrrp N preempt`. `no vrrp N ip <address>` removes the whole group.
 - OSPF settings for an interface sit on the interface, `ip ospf cost`, `ip ospf network ptp`, `ip ospf passive-interface enable`; passive is undone with `... disable`, not `no`.
-- `create vlan <list> active` holds every VLAN on one line. A change creates only the new VLANs and removes each gone one with `no vlan <id>`.
+- `create vlan <list> active` has every VLAN on one line. A change creates only the new VLANs and removes each one that is gone with `no vlan <id>`.
 - An access-list rule is not replaced by one with the same number: the device answers `Set unsuccessfully.` and keeps the old rule. The old one is removed first. `no rule N` answers slowly, after a second or more.

package/src/adapters/devices/routeros/TRAPS.md

@@ -3,11 +3,11 @@
 Behaviour that looks like something else. Each one has been hit on a real device.
 
 - Every command takes effect as it arrives; there is no candidate configuration. `apply` saves a backup, arms a scheduler that restores it, and restores at once if a command is refused.
-- A `/32` address gives no connected route, so a session over it never opens. State the far end: `{ address, peer }` renders `network=<peer>`.
+- A `/32` address gives no connected route, so a session over it never opens. Give the far end: `{ address, peer }` renders `network=<peer>`.
 - `[find address=X/Y]` unquoted matches nothing, silently. Every selector the plan builds is quoted.
 - `~` in `find` has no anchors. Match exactly.
 - A property of the same group is printed as a bare suffix, `output.filter-chain=X .network=Y`, which only reads back inside that command. The parser expands it before building a `set`.
-- `/routing bgp connection add` without `local.role` is refused, so the render always states one. On 7.23 one without `instance` is refused too, `missing value(s) of argument(s) instance`, although the export never prints `instance=default`.
+- `/routing bgp connection add` without `local.role` is refused, so the render always writes one. On 7.23 one without `instance` is refused too, `missing value(s) of argument(s) instance`, although the export never prints `instance=default`.
 - A connection without `input.filter` accepts everything. A neighbor without a policy is given `REJECT-ALL`.
 - A session edited repeatedly can stick: SYN both ways, no RST, no log. Remove the connection and add it again.
 - A session that never established is missing from `/routing bgp session print`; look at `/routing bgp connection print`.
@@ -27,17 +27,17 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - `mac-server` and `mac-winbox` work at layer 2 and ignore the IP firewall; they are limited by interface list.
 - `time-zone-autodetect` is on by default and wins after a restart. The render turns it off.
 - The SSH client drops a password sent together with its newline. Send the password, wait, then the newline.
-- A serial console login redraws lines unless the user name carries `+cwt`.
+- A serial console login redraws lines unless the user name has `+cwt`.
 - Narrowing a subnet is a change in several places: the address, the DHCP network, and every switch on the LAN. A mismatch breaks only the return path, so a test from the router passes.
 - In `find`, a quoted `"yes"` is a string and matches no boolean, silently. Plain words go bare; only values with a slash or a space are quoted.
-- `:put [:parse "..."]` compiles a command without running it and names a syntax error or an unknown property. `apply` checks every command this way before the backup is taken.
+- `:put [:parse "..."]` compiles a command without running it and reports a syntax error or an unknown property. `apply` checks every command this way before the backup is taken.
 - A refused command restores the backup, which restarts the router. Expect every session to re-establish over a minute or two.
 - `strong-crypto=yes` also hardens the device's own SSH client, which then fails silently toward devices that only speak older algorithms.
 - SNMPv3 authenticates with MD5 or SHA1 only on 7.23.
 - In a quoted string `$` starts a variable. The adapter escapes it.
 - A script sent over SSH exec runs as one line; a multi-line script fails with `expected closing brace`.
 - `:find` on an array returns a number or `nil`. Globals persist between exec commands of one login.
-- A fixed port speed is named by medium, `speed=10G-baseSR-LR` for an optic or `speed=1G-baseT-full` for copper, and only holds with `auto-negotiation=no`. With auto-negotiation back on, the export no longer prints the speed, so the plan resets only auto-negotiation. `speed=""` is refused as ambiguous and `unset speed` does not exist.
+- A fixed port speed is named by medium, `speed=10G-baseSR-LR` for an optic or `speed=1G-baseT-full` for copper, and only stays set with `auto-negotiation=no`. With auto-negotiation back on, the export no longer prints the speed, so the plan resets only auto-negotiation. `speed=""` is refused as ambiguous and `unset speed` does not exist.
 - `bgp-path-len` counts every AS in the path, prepends included, and takes the same strict comparisons as `dst-len`.
 - `:parse` checks the command, not the text inside `rule=`. A routing filter rule is only checked when it is added.
 - `/routing/filter/filter-wizard` adds the rule it builds; it is not a dry run. `set blackhole yes` was proved this way on 7.23, in an unused chain removed right after.