@takodotid/circuit 0.28.1 → 0.30.0

package/dist/chunks/{index-22sbskdx.js → index-47debt16.js}

@@ -117,7 +117,11 @@ function describeDevice(device) {
     const vrf = settings.vrf ? `, VRF ${settings.vrf}` : "";
     return `${name}: ${list.join(", ")}${vrf}`;
   });
-  return [`${device.platform} ${device.model}`, `reached at ${device.connection.host}`, ...addresses];
+  return [
+    `${device.platform} ${device.model}`,
+    device.connection.host ? `reached at ${device.connection.host}` : "reached through its console",
+    ...addresses
+  ];
 }
 function carriedBy(device, settings) {
   const vlan = (name, untagged) => {

package/dist/chunks/{server-1ftkqkx5.js → server-tjbb3rqc.js}

@@ -1,6 +1,6 @@
 import {
   packageRoot
-} from "./index-22sbskdx.js";
+} from "./index-47debt16.js";
 
 // src/studio/server.ts
 import { execFile as execFile2, spawn } from "node:child_process";

package/dist/cli/index.js

@@ -11,7 +11,7 @@ import {
   addressesOf,
   freeOfLength,
   studioData
-} from "../chunks/index-22sbskdx.js";
+} from "../chunks/index-47debt16.js";
 import {
   familyOf2,
   split,
@@ -118,6 +118,11 @@ import { Client as Client2 } from "ssh2";
 
 // src/transport/ssh.ts
 import { Client } from "ssh2";
+function managementHost(device) {
+  if (!device.connection.host)
+    throw new Error(`${device.name} has no management address; it is reached through its console`);
+  return device.connection.host;
+}
 function connect(login) {
   return new Promise((resolve, reject) => {
     const client = new Client;
@@ -530,6 +535,14 @@ class ConsoleShell {
 }
 
 // src/adapters/devices/fortios/names.ts
+function bridgesOf(device) {
+  return Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) => iface.type === "bridge" ? [{ name, members: iface.members }] : []);
+}
+var isTransparent = (device) => bridgesOf(device).length > 0;
+function forwardDomainOf(device, name) {
+  const index = bridgesOf(device).findIndex((bridge) => bridge.members.includes(name));
+  return index < 0 ? undefined : index + 1;
+}
 function nameOf(device, name) {
   if (device.interfaces && name in device.interfaces)
     return name;
@@ -710,6 +723,7 @@ function portList(ports) {
   const list = Array.isArray(ports) ? ports : [ports];
   return list.map((port) => typeof port === "number" ? String(port) : `${port.min}-${port.max}`);
 }
+var ALL_IN_TRANSPARENT = "circuit-all";
 function serviceOf(match, family) {
   const protocol = match?.protocol;
   const destinations = portList(match?.dst_port);
@@ -770,6 +784,10 @@ class Objects {
   }
   service(match, family) {
     const { name, block } = serviceOf(match, family);
+    if (name === "ALL" && isTransparent(this.device)) {
+      this.root.block("firewall service custom").entry(ALL_IN_TRANSPARENT).set("protocol", "IP");
+      return ALL_IN_TRANSPARENT;
+    }
     if (!block)
       return name;
     const entry = this.root.block("firewall service custom").entry(name);
@@ -1922,7 +1940,11 @@ function plan(desired, current, options) {
       removals.unshift({ title: `${section}, removed`, show: diff.removed, send: [`config ${header}`, ...diff.removals, "end"] });
     }
   }
-  return { steps: [...first, ...steps, ...removals, ...late], problems: [] };
+  const opmode = (root) => root.blocks.get("system settings")?.settings.get("opmode");
+  const problems = opmode(have) === "transparent" && opmode(want) !== "transparent" ? [
+    "the device runs in transparent mode and the config has no bridge; leave transparent mode by hand, `set opmode nat` with an address and an interface under `config system settings`, then plan again"
+  ] : [];
+  return { steps: [...first, ...steps, ...removals, ...late], problems };
 }
 var TUNNELS = "system interface, tunnels";
 function separateTunnels(root) {
@@ -2194,6 +2216,7 @@ function allowAccess(device) {
     services.push("fgfm");
   return services.join(" ");
 }
+var TRANSPARENT_MANAGEIP = "169.254.0.1/255.255.255.255";
 function render(device) {
   const root = new Block;
   for (const section of SECTIONS)
@@ -2203,6 +2226,8 @@ function render(device) {
   global(section("system global"), device);
   if (device.system?.banner)
     section(BANNER).set("buffer", quote(device.system.banner));
+  if (isTransparent(device))
+    section("system settings").set("opmode", "transparent").set("manageip", TRANSPARENT_MANAGEIP);
   if (natRules(device).length)
     section("system settings").set("central-nat", "enable");
   section("system settings").set("default-voip-alg-mode", "kernel-helper-based");
@@ -2329,6 +2354,9 @@ function interfaces(root, device) {
     if (parent)
       entry.set("interface", quote(nameOf(device, parent)));
     entry.set("vlanid", device.vlans?.[iface.vlan]?.id ?? 0);
+    const domain = forwardDomainOf(device, name);
+    if (domain)
+      entry.set("forward-domain", domain);
     if (iface.description)
       entry.set("description", quote(iface.description));
     if (iface.mtu)
@@ -2703,7 +2731,7 @@ async function login(device) {
   if (!user)
     throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
   return connect({
-    host: device.connection.host,
+    host: managementHost(device),
     port: device.connection.port,
     user: device.connection.user,
     password: resolve(user.password)
@@ -2893,7 +2921,18 @@ async function settle(device, options) {
   }
   return "the device did not come back in time and still reverts every change; set `cfg-save automatic` under `config system global`";
 }
-async function apply(device, _network, plan, options) {
+async function apply(device, network, changes, options) {
+  await applyOnce(device, changes, options);
+  const switched = changes.steps.some((step) => step.send.some((line) => line.startsWith("set opmode ")));
+  if (!switched)
+    return;
+  const again = plan(render(device), await read(device, network, options), options);
+  if (!again.steps.length)
+    return;
+  console.log("  the operation mode changed; applying what it added on its own");
+  await applyOnce(device, again, options);
+}
+async function applyOnce(device, plan, options) {
   const seconds = options.rollback * 60;
   try {
     if (options.console) {
@@ -2964,6 +3003,11 @@ function unsupported(device) {
   found.push(...serviceGaps(device));
   if (device.stp)
     found.push("stp, ports are routed");
+  found.push(...transparentGaps(device));
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type === "vlan" && iface.mac)
+      found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
+  }
   if (Object.keys(device.vrfs ?? {}).length > VRFS)
     found.push(`vrfs, at most ${VRFS}`);
   for (const [name, vrf] of Object.entries(device.vrfs ?? {})) {
@@ -2972,6 +3016,35 @@ function unsupported(device) {
   }
   return found;
 }
+function transparentGaps(device) {
+  if (!isTransparent(device))
+    return [];
+  const found = [];
+  const where = "in transparent mode, which a bridge needs";
+  if (device.connection.host)
+    found.push(`connection.host, ${where}: the device is reached through its console`);
+  for (const [name, port] of Object.entries(device.ports ?? {})) {
+    if (port?.addresses?.length)
+      found.push(`ports.${name}.addresses, ${where}`);
+  }
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.addresses?.length)
+      found.push(`interfaces.${name}.addresses, ${where}`);
+  }
+  const routing = device.routing;
+  if (routing?.static?.length || routing?.bgp || routing?.ospf)
+    found.push(`routing, ${where}`);
+  if (device.firewall?.nat)
+    found.push(`firewall.nat, ${where}`);
+  if (device.dhcp && Object.keys(device.dhcp).length)
+    found.push(`dhcp, ${where}`);
+  const management = device.management ?? {};
+  for (const service of ["ssh", "telnet", "http", "https", "api", "api_tls", "snmp", "native"]) {
+    if (management[service])
+      found.push(`management.${service}, ${where}: the device has no address to answer on`);
+  }
+  return found;
+}
 function systemGaps(device) {
   const found = [];
   const system = device.system ?? {};
@@ -3947,7 +4020,8 @@ function sflow(out, device, names) {
   const flow = device.flow_export;
   if (flow?.protocol !== "sflow")
     return;
-  out.set("protocols sflow agent-id", device.connection.host);
+  if (device.connection.host)
+    out.set("protocols sflow agent-id", device.connection.host);
   if (flow.sampling !== undefined)
     out.set("protocols sflow sample-rate ingress", flow.sampling);
   for (const collector of flow.collectors) {
@@ -4521,7 +4595,7 @@ async function login2(device) {
   if (!user)
     throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
   return connect({
-    host: device.connection.host,
+    host: managementHost(device),
     port: device.connection.port,
     user: device.connection.user,
     password: resolve(user.password)
@@ -4739,6 +4813,12 @@ async function apply2(device, _network, plan, options) {
 }
 function unsupported2(device) {
   const found = [];
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type === "bridge")
+      found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
+    if (iface.type === "vlan" && iface.mac)
+      found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
+  }
   const names = new Names(device);
   const users = device.users ?? {};
   const root = users.root;
@@ -5420,7 +5500,7 @@ async function sshShell(device) {
   if (!user)
     throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
   const client = await connect({
-    host: device.connection.host,
+    host: managementHost(device),
     port: device.connection.port,
     user: device.connection.user,
     password: resolve(user.password),
@@ -5489,6 +5569,12 @@ async function read3(device, _network = [], options = {}) {
 }
 function unsupported3(device) {
   const found = [];
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type === "bridge")
+      found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
+    if (iface.type === "vlan" && iface.mac)
+      found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
+  }
   for (const [name, port] of Object.entries(device.ports ?? {})) {
     if (!port)
       continue;
@@ -5813,6 +5899,7 @@ var DEFAULTS2 = {
     "limit-unknown-unicasts": "no"
   },
   "/interface vlan": { "l3-hw-offloading": "yes", mtu: "1500" },
+  "/interface macvlan": { mode: "bridge", mtu: "1500" },
   "/interface vrrp": { priority: "100", "preemption-mode": "yes", interval: "1s", version: "3", "v3-protocol": "ipv4" },
   "/interface vxlan": { port: "4789" },
   "/interface wireguard peers": {
@@ -5913,6 +6000,7 @@ var IDENTITY = {
   "/ipv6 firewall address-list": ["list", "address"],
   "/interface bridge port": ["interface"],
   "/interface bridge vlan": ["vlan-ids"],
+  "/interface vlan": ["interface", "vlan-id"],
   "/interface vxlan vteps": ["interface", "remote-ip"],
   "/routing bgp connection": ["remote.address"],
   "/routing rpki": ["address"],
@@ -5968,6 +6056,7 @@ var ORDER = [
   "/interface ethernet",
   "/interface bonding",
   "/interface vlan",
+  "/interface macvlan",
   "/interface gre",
   "/interface vxlan",
   "/interface wireguard",
@@ -6486,17 +6575,28 @@ function lags2(out, ctx) {
     }));
   }
 }
+var underMacvlan = (name) => `${name}-vlan`;
 function vlanInterfaces(out, ctx) {
   for (const [name, iface] of ctx.vlanInterfaces()) {
     const softwareOnly = ctx.device.hardware_offload && iface.hardware_offload === false;
+    const vlanName = iface.mac ? underMacvlan(name) : name;
     out.add("/interface vlan", command("add", {
       comment: iface.description,
       interface: BRIDGE,
       "l3-hw-offloading": softwareOnly ? "no" : undefined,
       mtu: iface.mtu,
-      name,
+      name: vlanName,
       "vlan-id": ctx.vlanId(iface.vlan)
     }));
+    if (iface.mac) {
+      out.add("/interface macvlan", command("add", {
+        comment: iface.description,
+        interface: vlanName,
+        "mac-address": iface.mac.toUpperCase(),
+        mtu: iface.mtu,
+        name
+      }));
+    }
   }
 }
 function tunnels(out, ctx) {
@@ -7346,7 +7446,7 @@ async function login3(device) {
   if (!user)
     throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
   return connect({
-    host: device.connection.host,
+    host: managementHost(device),
     port: device.connection.port,
     user: device.connection.user,
     password: resolve(user.password)
@@ -7442,6 +7542,10 @@ ${certificates}` : "";
 }
 function unsupported4(device) {
   const found = [];
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type === "bridge")
+      found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
+  }
   for (const [name, port] of Object.entries(device.ports ?? {})) {
     if (!port)
       continue;
@@ -7985,7 +8089,8 @@ function flowExport3(config, device) {
   const flow = device.flow_export;
   if (flow?.protocol !== "sflow")
     return;
-  config.line(`sflow agent ip ${device.connection.host}`);
+  if (device.connection.host)
+    config.line(`sflow agent ip ${device.connection.host}`);
   flow.collectors.forEach((collector, index) => {
     const number = FIRST_COLLECTOR + index;
     config.line(`sflow collector ${number} ip ${collector.address} udp-port ${collector.port ?? 6343}`);
@@ -8051,7 +8156,7 @@ async function login4(device) {
   if (!user)
     throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
   return connect({
-    host: device.connection.host,
+    host: managementHost(device),
     port: device.connection.port,
     user: device.connection.user,
     password: resolve(user.password),
@@ -8122,6 +8227,12 @@ function configurationOf(device, dump) {
 }
 function unsupported5(device) {
   const found = [];
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type === "bridge")
+      found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
+    if (iface.type === "vlan" && iface.mac)
+      found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
+  }
   for (const [name, port] of Object.entries(device.ports ?? {})) {
     if (!port)
       continue;
@@ -8357,8 +8468,9 @@ async function planLibreNms(network) {
   if (!response.ok)
     throw new Error(`LibreNMS answered ${response.status} to the device list`);
   const monitored = new Set((await response.json()).devices.map((device) => device.hostname));
-  const ours = new Set(network.devices.map((device) => device.connection.host));
-  const missing = network.devices.filter((device) => !monitored.has(device.connection.host));
+  const polled = network.devices.filter((device) => device.connection.host);
+  const ours = new Set(polled.map((device) => device.connection.host));
+  const missing = polled.filter((device) => !monitored.has(device.connection.host));
   return {
     additions: missing.filter((device) => device.management?.snmp),
     withoutSnmp: missing.filter((device) => !device.management?.snmp),
@@ -8481,7 +8593,7 @@ var AUTH2 = { sha1: "SHA", sha256: "SHA256" };
 var PRIVACY2 = { aes128: "AES", des: "DES" };
 function prometheusTargets(network) {
   return {
-    targets: network.devices.filter((device) => device.management?.snmp).map((device) => ({
+    targets: network.devices.filter((device) => device.management?.snmp && device.connection.host).map((device) => ({
       targets: [device.connection.host],
       labels: { device: device.name, platform: device.platform, model: device.model, __param_auth: device.name }
     })),
@@ -8838,6 +8950,8 @@ function checkDevice(device, report) {
   };
   if (!device.users?.[device.connection.user])
     report(`connection user '${device.connection.user}' is not one of its users`);
+  if (!device.connection.host && !device.connection.console)
+    report("connection has neither a host nor a console to reach the device through");
   checkVlans(device, report);
   checkAddresses2(device, report, cidr, ip);
   checkPorts(device, names, report);
@@ -8925,6 +9039,20 @@ function checkInterfaces(device, names, report, ip) {
       if (!members.length)
         report(`LAG ${name} has no member ports`);
     }
+    if (iface.type === "bridge") {
+      if (iface.members.length < 2)
+        report(`bridge ${name} joins fewer than two interfaces`);
+      for (const member of iface.members) {
+        const joined = device.interfaces?.[member];
+        if (joined?.type !== "vlan")
+          report(`bridge ${name}: member ${member} is not a VLAN interface`);
+        else if (joined.addresses?.length)
+          report(`bridge ${name}: member ${member} has an address of its own`);
+        const others = Object.entries(device.interfaces ?? {}).filter(([other, settings]) => other !== name && settings.type === "bridge" && settings.members.includes(member));
+        if (others.length)
+          report(`bridge ${name}: member ${member} is also in bridge ${others[0][0]}`);
+      }
+    }
     if (iface.type === "wireguard") {
       for (const peer of iface.peers ?? []) {
         for (const address of peer.allowed_addresses) {
@@ -9343,9 +9471,12 @@ function one() {
   const [device] = selected(false);
   return device ?? fail("name a device");
 }
+function optionsFor(device) {
+  return options.console || !device.connection.host ? { ...options, console: true } : options;
+}
 function adapterOf(device) {
   const adapter = adapters[device.platform] ?? fail(`no adapter for ${device.platform}`);
-  if (!options.console)
+  if (!optionsFor(device).console)
     return adapter;
   if (!adapter.console)
     fail(`${device.name}: ${device.platform} cannot be reached through a console yet`);
@@ -9419,7 +9550,7 @@ function diffCommand() {
 }
 async function snapshotCommand() {
   for (const device of selected(true)) {
-    const text = await adapterOf(device).read(device, network3.devices, options);
+    const text = await adapterOf(device).read(device, network3.devices, optionsFor(device));
     writeState(device, text);
     console.log(`${device.name}: ${text.split(`
 `).length} lines`);
@@ -9438,7 +9569,7 @@ async function applyCommand() {
   const device = one();
   guard([device]);
   const adapter = adapterOf(device);
-  const live = await adapter.read(device, network3.devices, options);
+  const live = await adapter.read(device, network3.devices, optionsFor(device));
   writeState(device, live);
   const plan = adapter.plan(adapter.render(device), live, options);
   if (!show(device, plan))
@@ -9451,8 +9582,8 @@ Not sent: resolve the problems first.`);
 Nothing sent. Re-run with --confirm.`);
     return;
   }
-  await adapter.apply(device, network3.devices, plan, options);
-  writeState(device, await adapter.read(device, network3.devices, options));
+  await adapter.apply(device, network3.devices, plan, optionsFor(device));
+  writeState(device, await adapter.read(device, network3.devices, optionsFor(device)));
   console.log("snapshot updated");
 }
 async function refreshCommand() {
@@ -9741,7 +9872,7 @@ async function studioCommand() {
   const port = Number(flagValue("port") ?? 4600);
   if (!Number.isInteger(port) || port < 1 || port > 65535)
     fail("--port takes a number from 1 to 65535");
-  const { isLoopback, studio } = await import("../chunks/server-1ftkqkx5.js");
+  const { isLoopback, studio } = await import("../chunks/server-tjbb3rqc.js");
   const host = flagValue("host") ?? "127.0.0.1";
   const allowHosts = (flagValue("allow-host") ?? "").split(",").filter(Boolean);
   if (!isLoopback(host) && !allowHosts.length) {

package/dist/types/adapters/devices/fortios/firewall.d.ts

@@ -8,6 +8,8 @@ export declare function natRules(device: Device): NatRule<string, string>[];
 export declare function familiesOf(device: Device, match: FilterMatch<string, string> | undefined): Family[];
 /** A port or ports as the platform writes them in a service: `22`, `1000-2000`. */
 export declare function portList(ports: Ports | undefined): string[];
+/** Every protocol, as a service of Circuit's own, for a device in transparent mode. */
+export declare const ALL_IN_TRANSPARENT = "circuit-all";
 /** The service a rule matches, by name, with what it holds. `ALL` when the rule names no protocol and no port; ports without a protocol are TCP's and UDP's. */
 export declare function serviceOf(match: FilterMatch<string, string> | undefined, family: Family): {
     name: string;

package/dist/types/adapters/devices/fortios/index.d.ts

@@ -49,7 +49,7 @@ export type Guard = {
  * Send a plan line by line, each applied as it arrives. The device is first set to revert what is not saved, so a refused line or a fresh login that fails reloads its saved configuration. Once access is proved the change is saved, and changes save themselves again.
  */
 export declare function configure(cli: Cli, plan: Plan, guard: Guard): Promise<void>;
-export declare function apply(device: Device, _network: readonly Device[], plan: Plan, options: ApplyOptions): Promise<void>;
+export declare function apply(device: Device, network: readonly Device[], changes: Plan, options: ApplyOptions): Promise<void>;
 /** The lines that replace a prefix list's entries with what a registry returned: every entry is purged, then each prefix added, matching it and anything more specific. */
 export declare function fillLines(set: string, family: Family, prefixes: string[]): string[];
 /** Replace a prefix list `refresh` fetched. It cannot cut access, so it is sent without a guard, and saved as it goes. `purge` asks to confirm, and is answered yes. */

package/dist/types/adapters/devices/fortios/names.d.ts

@@ -7,6 +7,15 @@ type Addressed = {
     vrf?: string;
     lag?: string;
 };
+/** The bridges a device has, in the config's order. A device with any runs in transparent mode, each bridge a forward domain numbered by its place. */
+export declare function bridgesOf(device: Device): {
+    name: string;
+    members: readonly string[];
+}[];
+/** Whether the device runs in transparent mode: it has a bridge. */
+export declare const isTransparent: (device: Device) => boolean;
+/** The forward domain of a VLAN interface in a bridge, or undefined. */
+export declare function forwardDomainOf(device: Device, name: string): number | undefined;
 /** The name the platform gives a port or an interface: a port by its spelling, any other interface by its key. */
 export declare function nameOf(device: Device, name: string): string;
 /** A port's or an interface's settings, by its key. */

package/dist/types/adapters/devices/fortios/render.d.ts

@@ -31,6 +31,8 @@ export declare const LEVEL: Record<Severity, string>;
 export declare const HELPERS: Partial<Record<Helper, readonly [string, number, number][]>>;
 /** Speed by the platform's spelling, for each class a port's cage takes. */
 export declare const SPEEDS: Record<string, Partial<Record<string, string>>>;
+/** The management address of a device in transparent mode, which is reached only through its console: link-local, on no network it can reach. */
+export declare const TRANSPARENT_MANAGEIP = "169.254.0.1/255.255.255.255";
 export declare function render(device: Device): string;
 /** The one port or LAG that carries a VLAN tagged, which its VLAN interface sits on. `unsupported()` refuses any other case. */
 export declare function vlanParent(device: Device, vlan: string): string | undefined;

package/dist/types/adapters/devices/routeros/render.d.ts

@@ -64,6 +64,8 @@ export declare function renderInterfaces(out: Output, ctx: Context): void;
 type Speed = NonNullable<AnyPort["speed"]>;
 /** The platform's name for a fixed speed on a port, or undefined when it has none. */
 export declare function mediumOf(platformPortName: string, speed: Speed): string | undefined;
+/** The name of the VLAN interface under one with a MAC of its own, which takes the configured name itself. */
+export declare const underMacvlan: (name: string) => string;
 /** The interface holding one VRRP group. */
 export declare const vrrpName: (iface: string, id: number) => string;
 /**

package/dist/types/schema/device.d.ts

@@ -6,8 +6,8 @@ import type { Routing } from "./routing";
 import type { Certificate, DhcpRelay, DhcpServer, FlowExport, Management, System, User } from "./system";
 /** How the framework reaches the device. */
 export type Connection<U extends string> = {
-    /** Management address. */
-    host: IP;
+    /** Management address. Absent for a device reached only through its console, `console`. */
+    host?: IP;
     /** One of the device's `users`. Its password is the login. */
     user: U;
     /** SSH port. 22 when absent. */

package/dist/types/schema/interfaces.d.ts

@@ -114,6 +114,10 @@ export type VlanInterface<V extends string, F extends string> = Base<F> & {
     type: "vlan";
     /** The VLAN it is on. */
     vlan: V;
+    /**
+     * A MAC address of its own, instead of the one it shares with the device's other VLAN interfaces. A gateway in front of a transparent firewall needs one: frames to it come back on another VLAN, where the bridge would otherwise take a shared MAC for its own and keep them.
+     */
+    mac?: string;
 };
 /** An interface that is always up and is on no link, for addresses that must not depend on one. */
 export type Loopback<F extends string> = Base<F> & {
@@ -176,6 +180,14 @@ export type WireGuard<F extends string> = Base<F> & {
     /** Who may connect. */
     peers?: readonly WireGuardPeer[];
 };
+/**
+ * A layer 2 bridge between VLAN interfaces, each keeping its own VLAN: a frame that comes in on one member leaves another with that member's tag. A firewall filters what crosses it, by the rules of its forward chain between the members, without routing it.
+ */
+export type Bridge<F extends string> = Base<F> & {
+    type: "bridge";
+    /** The VLAN interfaces it joins, by name. Each has no address of its own. */
+    members: readonly string[];
+};
 /** Any interface that is not a physical port. */
-export type Interface<V extends string, F extends string> = VlanInterface<V, F> | Loopback<F> | Lag<V, F> | Gre<F> | Vxlan<F> | WireGuard<F>;
+export type Interface<V extends string, F extends string> = VlanInterface<V, F> | Loopback<F> | Lag<V, F> | Gre<F> | Vxlan<F> | WireGuard<F> | Bridge<F>;
 export {};

package/dist/types/transport/ssh.d.ts

@@ -1,4 +1,5 @@
 import { Client, type ClientChannel } from "ssh2";
+import type { Device } from "../schema";
 export type Login = {
     host: string;
     port?: number;
@@ -7,6 +8,8 @@ export type Login = {
     /** Host key algorithms to accept, for a device that negotiates one it then signs wrongly. */
     hostKeys?: string[];
 };
+/** The address SSH reaches a device at. A device without one is reached only through its console. */
+export declare function managementHost(device: Device): string;
 /** Open a session. */
 export declare function connect(login: Login): Promise<Client>;
 /** Run one command and return what it printed, stderr included. */

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.28.1",
+    "version": "0.30.0",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",

package/src/adapters/devices/fortios/TRAPS.md

@@ -40,3 +40,6 @@ Behaviour that looks like something else. Each one has been hit on a FortiGate 3
 - The ports are `port1` to `port4` at 40G and `port5` to `port32` at 10G, then `mgmt1` and `mgmt2`. The factory dedicates both management ports to management and gives them addresses `192.168.1.99` and `192.168.2.99`.
 - On the serial console a line ends at a carriage return. A session left open stays logged in, and one left inside `config` stays there, so the next login must first leave and log out. The console takes 9600 bits per second: reading the sections Circuit manages takes about two minutes.
 - A data port can stay `netdev status: down`, with `rx_carrier: 0` in `diagnose hardware deviceinfo nic`, while the far end reads link-ok and frames reach the port's switch chip. Fixing the speed does not change it, in a LAG or out of one; a reboot does. `link_status: Up` there says nothing: a port with no cable shows it too.
+- Transparent mode, `set opmode transparent` under `config system settings`, refuses to start without a `manageip`: `Attribute 'manageip' MUST be set`. Switching to it takes every interface's address away, replaces the static routes with one default gateway, puts every port in one bridge, and deletes the factory's custom services, `ALL` among them, so a policy that names `ALL` is refused, `entry not found in datasource`. A link-local `manageip`, such as `169.254.0.1/255.255.255.255`, is accepted. It also adds an empty static route in each family and turns memory logging on, so an apply that switches the mode plans once more after it.
+- `forward-domain` exists only in transparent mode: in NAT mode it is `command parse error`. VLAN interfaces in the same forward domain are bridged, each frame leaving with the tag of the interface it leaves by.
+- Leaving transparent mode, `set opmode nat`, refuses `IP address must be a class A, B, or C ip` until an address is given with it.

package/src/adapters/devices/fortios/firewall.ts

@@ -2,7 +2,7 @@
 
 import { host } from "../../../core/addr";
 import type { AclRule, Device, Family, FilterMatch, FilterRule, NatRule, Ports, Protocol } from "../../../schema";
-import { familyOfPrefix, nameOf, network, subnet, withLength } from "./names";
+import { familyOfPrefix, isTransparent, nameOf, network, subnet, withLength } from "./names";
 import { Block, quote, quoteAll, UNSET } from "./tree";
 
 /** IP protocol numbers, for a protocol the platform names only by number. */
@@ -51,6 +51,9 @@ export function portList(ports: Ports | undefined): string[] {
     return list.map((port) => (typeof port === "number" ? String(port) : `${port.min}-${port.max}`));
 }
 
+/** Every protocol, as a service of Circuit's own, for a device in transparent mode. */
+export const ALL_IN_TRANSPARENT = "circuit-all";
+
 /** The service a rule matches, by name, with what it holds. `ALL` when the rule names no protocol and no port; ports without a protocol are TCP's and UDP's. */
 export function serviceOf(match: FilterMatch<string, string> | undefined, family: Family): { name: string; block?: Block } {
     const protocol = match?.protocol;
@@ -134,6 +137,13 @@ class Objects {
 
     service(match: FilterMatch<string, string> | undefined, family: Family): string {
         const { name, block } = serviceOf(match, family);
+
+        // Transparent mode deletes the factory's services, `ALL` with them, so every protocol is a service of Circuit's own there.
+        if (name === "ALL" && isTransparent(this.device)) {
+            this.root.block("firewall service custom").entry(ALL_IN_TRANSPARENT).set("protocol", "IP");
+            return ALL_IN_TRANSPARENT;
+        }
+
         if (!block) return name;
 
         const entry = this.root.block("firewall service custom").entry(name);

package/src/adapters/devices/fortios/index.ts

@@ -7,11 +7,11 @@ import { familyOf, host, split } from "../../../core/addr";
 import { MARKER, resolve, valueOfReference } from "../../../core/secrets";
 import type { AclRule, Device, Family, FilterRule } from "../../../schema";
 import { type ConsoleDialect, consoleLogin, consoleOf, openConsole } from "../../../transport/console";
-import { connect, shell } from "../../../transport/ssh";
+import { connect, managementHost, shell } from "../../../transport/ssh";
 import { portsOf, spell } from "../catalog";
 import type { ApplyOptions, DeviceAdapter, Plan, ReadOptions } from "../types";
 import { acceptsBeforeDrop, familiesOf, isImplied, serviceOf } from "./firewall";
-import { holderOf, interfaceFor, network, settingsOf, subnet } from "./names";
+import { holderOf, interfaceFor, isTransparent, network, settingsOf, subnet } from "./names";
 import { clean, plan } from "./plan";
 import { COLLECTORS, FULL, HELPERS, RESOLVERS, render, SECTIONS, SPEEDS, SSH_KEYS, vlanParent, VRFS, zoneOf } from "./render";
 import { BITS, PREFIX_LIST, routingGaps } from "./routing";
@@ -141,7 +141,7 @@ export async function login(device: Device): Promise<Client> {
     if (!user) throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
 
     return connect({
-        host: device.connection.host,
+        host: managementHost(device),
         port: device.connection.port,
         user: device.connection.user,
         password: resolve(user.password),
@@ -376,7 +376,21 @@ async function settle(device: Device, options: ReadOptions): Promise<string> {
     return "the device did not come back in time and still reverts every change; set `cfg-save automatic` under `config system global`";
 }
 
-export async function apply(device: Device, _network: readonly Device[], plan: Plan, options: ApplyOptions): Promise<void> {
+export async function apply(device: Device, network: readonly Device[], changes: Plan, options: ApplyOptions): Promise<void> {
+    await applyOnce(device, changes, options);
+
+    // Switching the operation mode makes changes of its own, such as a static route in each family and memory logging on, which a plan made before it could not see. One more pass, planned against what the device now runs, takes them back.
+    const switched = changes.steps.some((step) => step.send.some((line) => line.startsWith("set opmode ")));
+    if (!switched) return;
+
+    const again = plan(render(device), await read(device, network, options), options);
+    if (!again.steps.length) return;
+
+    console.log("  the operation mode changed; applying what it added on its own");
+    await applyOnce(device, again, options);
+}
+
+async function applyOnce(device: Device, plan: Plan, options: ApplyOptions): Promise<void> {
     const seconds = options.rollback * 60;
 
     try {
@@ -454,6 +468,11 @@ export function unsupported(device: Device): string[] {
     found.push(...serviceGaps(device));
 
     if (device.stp) found.push("stp, ports are routed");
+    found.push(...transparentGaps(device));
+
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+        if (iface.type === "vlan" && iface.mac) found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
+    }
     if (Object.keys(device.vrfs ?? {}).length > VRFS) found.push(`vrfs, at most ${VRFS}`);
 
     for (const [name, vrf] of Object.entries(device.vrfs ?? {})) {
@@ -463,6 +482,35 @@ export function unsupported(device: Device): string[] {
     return found;
 }
 
+/** What transparent mode, which a bridge needs, leaves out: every address, routing, NAT and the services that answer on an address. The device is reached through its console. */
+function transparentGaps(device: Device): string[] {
+    if (!isTransparent(device)) return [];
+
+    const found: string[] = [];
+    const where = "in transparent mode, which a bridge needs";
+
+    if (device.connection.host) found.push(`connection.host, ${where}: the device is reached through its console`);
+
+    for (const [name, port] of Object.entries(device.ports ?? {})) {
+        if (port?.addresses?.length) found.push(`ports.${name}.addresses, ${where}`);
+    }
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+        if (iface.addresses?.length) found.push(`interfaces.${name}.addresses, ${where}`);
+    }
+
+    const routing = device.routing;
+    if (routing?.static?.length || routing?.bgp || routing?.ospf) found.push(`routing, ${where}`);
+    if (device.firewall?.nat) found.push(`firewall.nat, ${where}`);
+    if (device.dhcp && Object.keys(device.dhcp).length) found.push(`dhcp, ${where}`);
+
+    const management = device.management ?? {};
+    for (const service of ["ssh", "telnet", "http", "https", "api", "api_tls", "snmp", "native"] as const) {
+        if (management[service]) found.push(`management.${service}, ${where}: the device has no address to answer on`);
+    }
+
+    return found;
+}
+
 function systemGaps(device: Device): string[] {
     const found: string[] = [];
     const system = device.system ?? {};

package/src/adapters/devices/fortios/names.ts

@@ -6,6 +6,22 @@ import { spell } from "../catalog";
 
 type Addressed = { addresses?: readonly (string | { address: string; peer?: string })[]; vrf?: string; lag?: string };
 
+/** The bridges a device has, in the config's order. A device with any runs in transparent mode, each bridge a forward domain numbered by its place. */
+export function bridgesOf(device: Device): { name: string; members: readonly string[] }[] {
+    return Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) =>
+        iface.type === "bridge" ? [{ name, members: iface.members }] : []
+    );
+}
+
+/** Whether the device runs in transparent mode: it has a bridge. */
+export const isTransparent = (device: Device) => bridgesOf(device).length > 0;
+
+/** The forward domain of a VLAN interface in a bridge, or undefined. */
+export function forwardDomainOf(device: Device, name: string): number | undefined {
+    const index = bridgesOf(device).findIndex((bridge) => bridge.members.includes(name));
+    return index < 0 ? undefined : index + 1;
+}
+
 /** The name the platform gives a port or an interface: a port by its spelling, any other interface by its key. */
 export function nameOf(device: Device, name: string): string {
     if (device.interfaces && name in device.interfaces) return name;

package/src/adapters/devices/fortios/plan.ts

@@ -805,7 +805,16 @@ export function plan(desired: string, current: string, options: Pick<ApplyOption
         }
     }
 
-    return { steps: [...first, ...steps, ...removals, ...late], problems: [] };
+    // Leaving transparent mode needs an address and an interface for it, which the config of a device without a bridge does not say.
+    const opmode = (root: Block) => root.blocks.get("system settings")?.settings.get("opmode");
+    const problems =
+        opmode(have) === "transparent" && opmode(want) !== "transparent"
+            ? [
+                  "the device runs in transparent mode and the config has no bridge; leave transparent mode by hand, `set opmode nat` with an address and an interface under `config system settings`, then plan again",
+              ]
+            : [];
+
+    return { steps: [...first, ...steps, ...removals, ...late], problems };
 }
 
 /** The interfaces of tunnels, which their own tables create, compared after those tables as a section of their own. */

package/src/adapters/devices/fortios/render.ts

@@ -5,7 +5,18 @@ import { marker } from "../../../core/secrets";
 import type { Device, Helper, Severity } from "../../../schema";
 import { portsOf, spell } from "../catalog";
 import { firewall, natRules } from "./firewall";
-import { addressed, addressesOf, holderOf, interfaceFor, nameOf, network, subnet, vrfNumber } from "./names";
+import {
+    addressed,
+    addressesOf,
+    forwardDomainOf,
+    holderOf,
+    interfaceFor,
+    isTransparent,
+    nameOf,
+    network,
+    subnet,
+    vrfNumber,
+} from "./names";
 import { routing, usesBfd } from "./routing";
 import { Block, print, quote, quoteAll } from "./tree";
 
@@ -246,6 +257,9 @@ function allowAccess(device: Device): string {
     return services.join(" ");
 }
 
+/** The management address of a device in transparent mode, which is reached only through its console: link-local, on no network it can reach. */
+export const TRANSPARENT_MANAGEIP = "169.254.0.1/255.255.255.255";
+
 export function render(device: Device): string {
     const root = new Block();
     for (const section of SECTIONS) root.block(section);
@@ -255,6 +269,8 @@ export function render(device: Device): string {
     certificates(section("vpn certificate local"), section("vpn certificate ca"), device);
     global(section("system global"), device);
     if (device.system?.banner) section(BANNER).set("buffer", quote(device.system.banner));
+    // A bridge needs transparent mode, and transparent mode a management address. One on no network the device can reach keeps it reached only through its console.
+    if (isTransparent(device)) section("system settings").set("opmode", "transparent").set("manageip", TRANSPARENT_MANAGEIP);
     if (natRules(device).length) section("system settings").set("central-nat", "enable");
     // SIP is otherwise rewritten by its proxy whatever the helpers say; this way only the `sip` helper does.
     section("system settings").set("default-voip-alg-mode", "kernel-helper-based");
@@ -391,6 +407,8 @@ function interfaces(root: Block, device: Device): void {
         entry.set("vdom", quote("root"));
         if (parent) entry.set("interface", quote(nameOf(device, parent)));
         entry.set("vlanid", device.vlans?.[iface.vlan]?.id ?? 0);
+        const domain = forwardDomainOf(device, name);
+        if (domain) entry.set("forward-domain", domain);
         if (iface.description) entry.set("description", quote(iface.description));
         if (iface.mtu) entry.set("mtu-override", "enable").set("mtu", iface.mtu);
         redirects(entry, device);

package/src/adapters/devices/junos/index.ts

@@ -7,7 +7,7 @@ import { familyOf, host, isAddress, split } from "../../../core/addr";
 import { resolve, substitute } from "../../../core/secrets";
 import type { Device, Family } from "../../../schema";
 import { type ConsoleDialect, consoleLogin, consoleOf, openConsole } from "../../../transport/console";
-import { connect, exec, readUntil, shell } from "../../../transport/ssh";
+import { connect, exec, managementHost, readUntil, shell } from "../../../transport/ssh";
 import { lagIds } from "../derive";
 import type { ApplyOptions, DeviceAdapter, Plan, ReadOptions, Step } from "../types";
 import { GENERATED, settingsOf } from "./bgp";
@@ -296,7 +296,7 @@ export async function login(device: Device): Promise<Client> {
     if (!user) throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
 
     return connect({
-        host: device.connection.host,
+        host: managementHost(device),
         port: device.connection.port,
         user: device.connection.user,
         password: resolve(user.password),
@@ -565,6 +565,11 @@ export async function apply(device: Device, _network: readonly Device[], plan: P
 
 export function unsupported(device: Device): string[] {
     const found: string[] = [];
+
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+        if (iface.type === "bridge") found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
+        if (iface.type === "vlan" && iface.mac) found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
+    }
     const names = new Names(device);
     const users = device.users ?? {};
 

package/src/adapters/devices/junos/render.ts

@@ -675,7 +675,7 @@ function sflow(out: Statements, device: Device, names: Names): void {
     const flow = device.flow_export;
     if (flow?.protocol !== "sflow") return;
 
-    out.set("protocols sflow agent-id", device.connection.host);
+    if (device.connection.host) out.set("protocols sflow agent-id", device.connection.host);
     if (flow.sampling !== undefined) out.set("protocols sflow sample-rate ingress", flow.sampling);
 
     for (const collector of flow.collectors) {

package/src/adapters/devices/raisecom-ros/index.ts

@@ -8,7 +8,7 @@ import { marker, resolve, substitute } from "../../../core/secrets";
 import { offset } from "../../../core/time";
 import type { Device, Port, SnmpUser, Switched, Vrrp } from "../../../schema";
 import { type ConsoleDialect, consoleLogin, consoleOf, openConsole } from "../../../transport/console";
-import { connect, readUntil, send, shell } from "../../../transport/ssh";
+import { connect, managementHost, readUntil, send, shell } from "../../../transport/ssh";
 import { portsOf, spell } from "../catalog";
 import { ipv4Networks, lagIds, switchUnsupported } from "../derive";
 import { compare, type Dialect, entries, type Group, scrub, steps, vlanListChange } from "../lines";
@@ -338,7 +338,7 @@ async function sshShell(device: Device): Promise<Session> {
     if (!user) throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
 
     const client = await connect({
-        host: device.connection.host,
+        host: managementHost(device),
         port: device.connection.port,
         user: device.connection.user,
         password: resolve(user.password),
@@ -420,6 +420,11 @@ export async function read(device: Device, _network: readonly Device[] = [], opt
 export function unsupported(device: Device): string[] {
     const found: string[] = [];
 
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+        if (iface.type === "bridge") found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
+        if (iface.type === "vlan" && iface.mac) found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
+    }
+
     for (const [name, port] of Object.entries(device.ports ?? {})) {
         if (!port) continue;
 

package/src/adapters/devices/routeros/TRAPS.md

@@ -42,3 +42,5 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - `:parse` checks the command, not the text inside `rule=`. A routing filter rule is only checked when it is added.
 - `/routing/filter/filter-wizard` adds the rule it builds; it is not a dry run. `set blackhole yes` was proved this way on 7.23, in an unused chain removed right after.
 - On the serial console, the prompt can come twice after a login. The console echoes a long command wrapped at 80 columns, and a `print` that fills the screen stops at `-- [Q quit|D dump|down]`, where `D` prints the rest.
+- Every VLAN interface on the bridge has the bridge's MAC, and the bridge keeps a frame to that MAC on whatever VLAN it arrives. A gateway in front of a transparent firewall then never gets its replies: they come back on the inside VLAN and stop at the bridge. A MACVLAN on the VLAN interface gives the gateway a MAC of its own, and its replies cross the firewall back; proved with a FortiGate 3700D in transparent mode, the session offloaded to its NP6.
+- A second VLAN interface with the same VLAN ID on the same interface is refused, `already have such vlan`, so a VLAN interface is known by its interface and VLAN ID, and a new name is a rename.

package/src/adapters/devices/routeros/export.ts

@@ -131,6 +131,7 @@ export const DEFAULTS: Record<string, Record<string, string>> = {
         "limit-unknown-unicasts": "no",
     },
     "/interface vlan": { "l3-hw-offloading": "yes", mtu: "1500" },
+    "/interface macvlan": { mode: "bridge", mtu: "1500" },
     "/interface vrrp": { priority: "100", "preemption-mode": "yes", interval: "1s", version: "3", "v3-protocol": "ipv4" },
     "/interface vxlan": { port: "4789" },
     "/interface wireguard peers": {
@@ -259,6 +260,8 @@ const IDENTITY: Record<string, string[]> = {
     "/ipv6 firewall address-list": ["list", "address"],
     "/interface bridge port": ["interface"],
     "/interface bridge vlan": ["vlan-ids"],
+    // One VLAN ID per interface: the device refuses a second, so a rename, such as one a MAC of its own brings, is a rename.
+    "/interface vlan": ["interface", "vlan-id"],
     "/interface vxlan vteps": ["interface", "remote-ip"],
     "/routing bgp connection": ["remote.address"],
     "/routing rpki": ["address"],

package/src/adapters/devices/routeros/index.ts

@@ -7,7 +7,7 @@ import { familyOf } from "../../../core/addr";
 import { resolve, substitute } from "../../../core/secrets";
 import type { Device, Family } from "../../../schema";
 import { type ConsoleDialect, consoleLogin, consoleOf, ConsoleShell, openConsole } from "../../../transport/console";
-import { connect, exec, upload } from "../../../transport/ssh";
+import { connect, exec, managementHost, upload } from "../../../transport/ssh";
 import type { ApplyOptions, DeviceAdapter, Plan, ReadOptions } from "../types";
 import { INSTALL_CERTIFICATE, plan } from "./plan";
 import { spell } from "../catalog";
@@ -21,7 +21,7 @@ export async function login(device: Device): Promise<Client> {
     if (!user) throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
 
     return connect({
-        host: device.connection.host,
+        host: managementHost(device),
         port: device.connection.port,
         user: device.connection.user,
         password: resolve(user.password),
@@ -151,6 +151,10 @@ export async function read(device: Device, _network: readonly Device[] = [], opt
 export function unsupported(device: Device): string[] {
     const found: string[] = [];
 
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+        if (iface.type === "bridge") found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
+    }
+
     for (const [name, port] of Object.entries(device.ports ?? {})) {
         if (!port) continue;
 

package/src/adapters/devices/routeros/plan.ts

@@ -16,6 +16,7 @@ const ORDER = [
     "/interface ethernet",
     "/interface bonding",
     "/interface vlan",
+    "/interface macvlan",
     "/interface gre",
     "/interface vxlan",
     "/interface wireguard",

package/src/adapters/devices/routeros/render.ts

@@ -344,10 +344,19 @@ function lags(out: Output, ctx: Context): void {
     }
 }
 
-/** A VLAN interface sits on the bridge. When the device offloads, one that opts out is routed in software so the firewall applies. */
+/** The name of the VLAN interface under one with a MAC of its own, which takes the configured name itself. */
+export const underMacvlan = (name: string) => `${name}-vlan`;
+
+/**
+ * A VLAN interface sits on the bridge. When the device offloads, one that opts out is routed in software so the firewall applies.
+ *
+ * Every VLAN interface on the bridge has the bridge's MAC. One with a MAC of its own is a MACVLAN on top of the VLAN interface: the MACVLAN takes the configured name, so its addresses and every rule naming it land on it.
+ */
 function vlanInterfaces(out: Output, ctx: Context): void {
     for (const [name, iface] of ctx.vlanInterfaces()) {
         const softwareOnly = ctx.device.hardware_offload && iface.hardware_offload === false;
+        const vlanName = iface.mac ? underMacvlan(name) : name;
+
         out.add(
             "/interface vlan",
             command("add", {
@@ -355,10 +364,23 @@ function vlanInterfaces(out: Output, ctx: Context): void {
                 interface: BRIDGE,
                 "l3-hw-offloading": softwareOnly ? "no" : undefined,
                 mtu: iface.mtu,
-                name,
+                name: vlanName,
                 "vlan-id": ctx.vlanId(iface.vlan),
             })
         );
+
+        if (iface.mac) {
+            out.add(
+                "/interface macvlan",
+                command("add", {
+                    comment: iface.description,
+                    interface: vlanName,
+                    "mac-address": iface.mac.toUpperCase(),
+                    mtu: iface.mtu,
+                    name,
+                })
+            );
+        }
     }
 }
 

package/src/adapters/devices/vrp/index.ts

@@ -8,7 +8,7 @@ import { marker, resolve, substitute, valueOfReference } from "../../../core/sec
 import { offset } from "../../../core/time";
 import type { Device, Interface, Port, Vrrp } from "../../../schema";
 import { type ConsoleDialect, consoleLogin, consoleOf, openConsole } from "../../../transport/console";
-import { connect, readUntil, send, shell } from "../../../transport/ssh";
+import { connect, managementHost, readUntil, send, shell } from "../../../transport/ssh";
 import { portsOf, spell } from "../catalog";
 import { ipv4Networks, lagIds, switchUnsupported } from "../derive";
 import { compare, type Dialect, scrub, steps, vlanListChange } from "../lines";
@@ -465,7 +465,7 @@ function flowExport(config: Config, device: Device): void {
     const flow = device.flow_export;
     if (flow?.protocol !== "sflow") return;
 
-    config.line(`sflow agent ip ${device.connection.host}`);
+    if (device.connection.host) config.line(`sflow agent ip ${device.connection.host}`);
 
     flow.collectors.forEach((collector, index) => {
         const number = FIRST_COLLECTOR + index;
@@ -550,7 +550,7 @@ export async function login(device: Device): Promise<Client> {
     const user = device.users?.[device.connection.user];
     if (!user) throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
     return connect({
-        host: device.connection.host,
+        host: managementHost(device),
         port: device.connection.port,
         user: device.connection.user,
         password: resolve(user.password),
@@ -637,6 +637,11 @@ function configurationOf(device: Device, dump: string): string {
 export function unsupported(device: Device): string[] {
     const found: string[] = [];
 
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+        if (iface.type === "bridge") found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
+        if (iface.type === "vlan" && iface.mac) found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
+    }
+
     for (const [name, port] of Object.entries(device.ports ?? {})) {
         if (!port) continue;
 

package/src/adapters/registries/librenms.ts

@@ -57,8 +57,10 @@ export async function planLibreNms(network: Network): Promise<LibreNmsPlan> {
     if (!response.ok) throw new Error(`LibreNMS answered ${response.status} to the device list`);
 
     const monitored = new Set(((await response.json()) as { devices: { hostname: string }[] }).devices.map((device) => device.hostname));
-    const ours = new Set(network.devices.map((device) => device.connection.host));
-    const missing = network.devices.filter((device) => !monitored.has(device.connection.host));
+    // A device reached only through its console has no address to poll.
+    const polled = network.devices.filter((device) => device.connection.host);
+    const ours = new Set(polled.map((device) => device.connection.host));
+    const missing = polled.filter((device) => !monitored.has(device.connection.host!));
 
     return {
         additions: missing.filter((device) => device.management?.snmp),

package/src/adapters/registries/prometheus.ts

@@ -15,9 +15,9 @@ const PRIVACY = { aes128: "AES", des: "DES" } as const;
 export function prometheusTargets(network: Network): { targets: PrometheusTarget[]; withoutSnmp: Device[] } {
     return {
         targets: network.devices
-            .filter((device) => device.management?.snmp)
+            .filter((device) => device.management?.snmp && device.connection.host)
             .map((device) => ({
-                targets: [device.connection.host],
+                targets: [device.connection.host!],
                 // `__param_auth` picks the device's own auth in snmp_exporter.
                 labels: { device: device.name, platform: device.platform, model: device.model, __param_auth: device.name },
             })),

package/src/cli/index.ts

@@ -133,10 +133,15 @@ function one(): Device {
     return device ?? fail("name a device");
 }
 
-/** The adapter of a device, which must be able to use its console when `--console` asks for it. */
+/** How a device is reached: through its console when `--console` asks, or when it has no management address. */
+function optionsFor(device: Device): ApplyOptions {
+    return options.console || !device.connection.host ? { ...options, console: true } : options;
+}
+
+/** The adapter of a device, which must be able to use its console when the device is reached through it. */
 function adapterOf(device: Device): DeviceAdapter {
     const adapter = adapters[device.platform] ?? fail(`no adapter for ${device.platform}`);
-    if (!options.console) return adapter;
+    if (!optionsFor(device).console) return adapter;
 
     if (!adapter.console) fail(`${device.name}: ${device.platform} cannot be reached through a console yet`);
     if (!device.connection.console) fail(`${device.name}: --console needs connection.console`);
@@ -225,7 +230,7 @@ function diffCommand(): void {
 
 async function snapshotCommand(): Promise<void> {
     for (const device of selected(true)) {
-        const text = await adapterOf(device).read(device, network.devices, options);
+        const text = await adapterOf(device).read(device, network.devices, optionsFor(device));
         writeState(device, text);
         console.log(`${device.name}: ${text.split("\n").length} lines`);
     }
@@ -248,7 +253,7 @@ async function applyCommand(): Promise<void> {
     const adapter = adapterOf(device);
 
     // The plan is made against what the device runs now, never against an old snapshot.
-    const live = await adapter.read(device, network.devices, options);
+    const live = await adapter.read(device, network.devices, optionsFor(device));
     writeState(device, live);
 
     const plan = adapter.plan(adapter.render(device), live, options);
@@ -261,9 +266,9 @@ async function applyCommand(): Promise<void> {
         return;
     }
 
-    await adapter.apply(device, network.devices, plan, options);
+    await adapter.apply(device, network.devices, plan, optionsFor(device));
 
-    writeState(device, await adapter.read(device, network.devices, options));
+    writeState(device, await adapter.read(device, network.devices, optionsFor(device)));
     console.log("snapshot updated");
 }
 

package/src/core/graph.ts

@@ -143,7 +143,11 @@ function describeDevice(device: Device): string[] {
             return `${name}: ${list.join(", ")}${vrf}`;
         });
 
-    return [`${device.platform} ${device.model}`, `reached at ${device.connection.host}`, ...addresses];
+    return [
+        `${device.platform} ${device.model}`,
+        device.connection.host ? `reached at ${device.connection.host}` : "reached through its console",
+        ...addresses,
+    ];
 }
 
 /** The VLANs a port or LAG carries, by id. */

package/src/core/validate.ts

@@ -79,6 +79,8 @@ function checkDevice(device: Device, report: Report): void {
     };
 
     if (!device.users?.[device.connection.user]) report(`connection user '${device.connection.user}' is not one of its users`);
+    if (!device.connection.host && !device.connection.console)
+        report("connection has neither a host nor a console to reach the device through");
 
     checkVlans(device, report);
     checkAddresses(device, report, cidr, ip);
@@ -173,6 +175,21 @@ function checkInterfaces(device: Device, names: Names, report: Report, ip: Check
             if (!members.length) report(`LAG ${name} has no member ports`);
         }
 
+        if (iface.type === "bridge") {
+            if (iface.members.length < 2) report(`bridge ${name} joins fewer than two interfaces`);
+
+            for (const member of iface.members) {
+                const joined = device.interfaces?.[member];
+                if (joined?.type !== "vlan") report(`bridge ${name}: member ${member} is not a VLAN interface`);
+                else if (joined.addresses?.length) report(`bridge ${name}: member ${member} has an address of its own`);
+
+                const others = Object.entries(device.interfaces ?? {}).filter(
+                    ([other, settings]) => other !== name && settings.type === "bridge" && settings.members.includes(member)
+                );
+                if (others.length) report(`bridge ${name}: member ${member} is also in bridge ${others[0]![0]}`);
+            }
+        }
+
         if (iface.type === "wireguard") {
             for (const peer of iface.peers ?? []) {
                 for (const address of peer.allowed_addresses) {

package/src/schema/device.ts

@@ -7,8 +7,8 @@ import type { Certificate, DhcpRelay, DhcpServer, FlowExport, Management, System
 
 /** How the framework reaches the device. */
 export type Connection<U extends string> = {
-    /** Management address. */
-    host: IP;
+    /** Management address. Absent for a device reached only through its console, `console`. */
+    host?: IP;
     /** One of the device's `users`. Its password is the login. */
     user: U;
     /** SSH port. 22 when absent. */

package/src/schema/interfaces.ts

@@ -119,6 +119,10 @@ export type VlanInterface<V extends string, F extends string> = Base<F> & {
     type: "vlan";
     /** The VLAN it is on. */
     vlan: V;
+    /**
+     * A MAC address of its own, instead of the one it shares with the device's other VLAN interfaces. A gateway in front of a transparent firewall needs one: frames to it come back on another VLAN, where the bridge would otherwise take a shared MAC for its own and keep them.
+     */
+    mac?: string;
 };
 
 /** An interface that is always up and is on no link, for addresses that must not depend on one. */
@@ -187,6 +191,15 @@ export type WireGuard<F extends string> = Base<F> & {
     peers?: readonly WireGuardPeer[];
 };
 
+/**
+ * A layer 2 bridge between VLAN interfaces, each keeping its own VLAN: a frame that comes in on one member leaves another with that member's tag. A firewall filters what crosses it, by the rules of its forward chain between the members, without routing it.
+ */
+export type Bridge<F extends string> = Base<F> & {
+    type: "bridge";
+    /** The VLAN interfaces it joins, by name. Each has no address of its own. */
+    members: readonly string[];
+};
+
 /** Any interface that is not a physical port. */
 export type Interface<V extends string, F extends string> =
-    VlanInterface<V, F> | Loopback<F> | Lag<V, F> | Gre<F> | Vxlan<F> | WireGuard<F>;
+    VlanInterface<V, F> | Loopback<F> | Lag<V, F> | Gre<F> | Vxlan<F> | WireGuard<F> | Bridge<F>;

package/src/transport/ssh.ts

@@ -1,6 +1,7 @@
 // SSH sessions to devices. Adapters choose how to talk to their platform; this holds what they share.
 
 import { Client, type ClientChannel } from "ssh2";
+import type { Device } from "../schema";
 
 export type Login = {
     host: string;
@@ -11,6 +12,12 @@ export type Login = {
     hostKeys?: string[];
 };
 
+/** The address SSH reaches a device at. A device without one is reached only through its console. */
+export function managementHost(device: Device): string {
+    if (!device.connection.host) throw new Error(`${device.name} has no management address; it is reached through its console`);
+    return device.connection.host;
+}
+
 /** Open a session. */
 export function connect(login: Login): Promise<Client> {
     return new Promise((resolve, reject) => {