@takodotid/circuit 0.29.0 → 0.31.0

package/dist/cli/index.js

@@ -535,6 +535,14 @@ class ConsoleShell {
 }
 
 // src/adapters/devices/fortios/names.ts
+function bridgesOf(device) {
+  return Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) => iface.type === "bridge" ? [{ name, members: iface.members }] : []);
+}
+var isTransparent = (device) => bridgesOf(device).length > 0;
+function forwardDomainOf(device, name) {
+  const index = bridgesOf(device).findIndex((bridge) => bridge.members.includes(name));
+  return index < 0 ? undefined : index + 1;
+}
 function nameOf(device, name) {
   if (device.interfaces && name in device.interfaces)
     return name;
@@ -715,6 +723,7 @@ function portList(ports) {
   const list = Array.isArray(ports) ? ports : [ports];
   return list.map((port) => typeof port === "number" ? String(port) : `${port.min}-${port.max}`);
 }
+var ALL_IN_TRANSPARENT = "circuit-all";
 function serviceOf(match, family) {
   const protocol = match?.protocol;
   const destinations = portList(match?.dst_port);
@@ -775,6 +784,10 @@ class Objects {
   }
   service(match, family) {
     const { name, block } = serviceOf(match, family);
+    if (name === "ALL" && isTransparent(this.device)) {
+      this.root.block("firewall service custom").entry(ALL_IN_TRANSPARENT).set("protocol", "IP");
+      return ALL_IN_TRANSPARENT;
+    }
     if (!block)
       return name;
     const entry = this.root.block("firewall service custom").entry(name);
@@ -1927,7 +1940,11 @@ function plan(desired, current, options) {
       removals.unshift({ title: `${section}, removed`, show: diff.removed, send: [`config ${header}`, ...diff.removals, "end"] });
     }
   }
-  return { steps: [...first, ...steps, ...removals, ...late], problems: [] };
+  const opmode = (root) => root.blocks.get("system settings")?.settings.get("opmode");
+  const problems = opmode(have) === "transparent" && opmode(want) !== "transparent" ? [
+    "the device runs in transparent mode and the config has no bridge; leave transparent mode by hand, `set opmode nat` with an address and an interface under `config system settings`, then plan again"
+  ] : [];
+  return { steps: [...first, ...steps, ...removals, ...late], problems };
 }
 var TUNNELS = "system interface, tunnels";
 function separateTunnels(root) {
@@ -2199,6 +2216,7 @@ function allowAccess(device) {
     services.push("fgfm");
   return services.join(" ");
 }
+var TRANSPARENT_MANAGEIP = "169.254.0.1/255.255.255.255";
 function render(device) {
   const root = new Block;
   for (const section of SECTIONS)
@@ -2208,6 +2226,8 @@ function render(device) {
   global(section("system global"), device);
   if (device.system?.banner)
     section(BANNER).set("buffer", quote(device.system.banner));
+  if (isTransparent(device))
+    section("system settings").set("opmode", "transparent").set("manageip", TRANSPARENT_MANAGEIP);
   if (natRules(device).length)
     section("system settings").set("central-nat", "enable");
   section("system settings").set("default-voip-alg-mode", "kernel-helper-based");
@@ -2334,6 +2354,9 @@ function interfaces(root, device) {
     if (parent)
       entry.set("interface", quote(nameOf(device, parent)));
     entry.set("vlanid", device.vlans?.[iface.vlan]?.id ?? 0);
+    const domain = forwardDomainOf(device, name);
+    if (domain)
+      entry.set("forward-domain", domain);
     if (iface.description)
       entry.set("description", quote(iface.description));
     if (iface.mtu)
@@ -2898,7 +2921,18 @@ async function settle(device, options) {
   }
   return "the device did not come back in time and still reverts every change; set `cfg-save automatic` under `config system global`";
 }
-async function apply(device, _network, plan, options) {
+async function apply(device, network, changes, options) {
+  await applyOnce(device, changes, options);
+  const switched = changes.steps.some((step) => step.send.some((line) => line.startsWith("set opmode ")));
+  if (!switched)
+    return;
+  const again = plan(render(device), await read(device, network, options), options);
+  if (!again.steps.length)
+    return;
+  console.log("  the operation mode changed; applying what it added on its own");
+  await applyOnce(device, again, options);
+}
+async function applyOnce(device, plan, options) {
   const seconds = options.rollback * 60;
   try {
     if (options.console) {
@@ -2969,6 +3003,11 @@ function unsupported(device) {
   found.push(...serviceGaps(device));
   if (device.stp)
     found.push("stp, ports are routed");
+  found.push(...transparentGaps(device));
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type === "vlan" && iface.mac)
+      found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
+  }
   if (Object.keys(device.vrfs ?? {}).length > VRFS)
     found.push(`vrfs, at most ${VRFS}`);
   for (const [name, vrf] of Object.entries(device.vrfs ?? {})) {
@@ -2977,6 +3016,35 @@ function unsupported(device) {
   }
   return found;
 }
+function transparentGaps(device) {
+  if (!isTransparent(device))
+    return [];
+  const found = [];
+  const where = "in transparent mode, which a bridge needs";
+  if (device.connection.host)
+    found.push(`connection.host, ${where}: the device is reached through its console`);
+  for (const [name, port] of Object.entries(device.ports ?? {})) {
+    if (port?.addresses?.length)
+      found.push(`ports.${name}.addresses, ${where}`);
+  }
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.addresses?.length)
+      found.push(`interfaces.${name}.addresses, ${where}`);
+  }
+  const routing = device.routing;
+  if (routing?.static?.length || routing?.bgp || routing?.ospf)
+    found.push(`routing, ${where}`);
+  if (device.firewall?.nat)
+    found.push(`firewall.nat, ${where}`);
+  if (device.dhcp && Object.keys(device.dhcp).length)
+    found.push(`dhcp, ${where}`);
+  const management = device.management ?? {};
+  for (const service of ["ssh", "telnet", "http", "https", "api", "api_tls", "snmp", "native"]) {
+    if (management[service])
+      found.push(`management.${service}, ${where}: the device has no address to answer on`);
+  }
+  return found;
+}
 function systemGaps(device) {
   const found = [];
   const system = device.system ?? {};
@@ -4745,6 +4813,12 @@ async function apply2(device, _network, plan, options) {
 }
 function unsupported2(device) {
   const found = [];
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type === "bridge")
+      found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
+    if (iface.type === "vlan" && iface.mac)
+      found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
+  }
   const names = new Names(device);
   const users = device.users ?? {};
   const root = users.root;
@@ -5495,6 +5569,12 @@ async function read3(device, _network = [], options = {}) {
 }
 function unsupported3(device) {
   const found = [];
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type === "bridge")
+      found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
+    if (iface.type === "vlan" && iface.mac)
+      found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
+  }
   for (const [name, port] of Object.entries(device.ports ?? {})) {
     if (!port)
       continue;
@@ -5819,6 +5899,7 @@ var DEFAULTS2 = {
     "limit-unknown-unicasts": "no"
   },
   "/interface vlan": { "l3-hw-offloading": "yes", mtu: "1500" },
+  "/interface macvlan": { mode: "bridge", mtu: "1500" },
   "/interface vrrp": { priority: "100", "preemption-mode": "yes", interval: "1s", version: "3", "v3-protocol": "ipv4" },
   "/interface vxlan": { port: "4789" },
   "/interface wireguard peers": {
@@ -5919,6 +6000,7 @@ var IDENTITY = {
   "/ipv6 firewall address-list": ["list", "address"],
   "/interface bridge port": ["interface"],
   "/interface bridge vlan": ["vlan-ids"],
+  "/interface vlan": ["interface", "vlan-id"],
   "/interface vxlan vteps": ["interface", "remote-ip"],
   "/routing bgp connection": ["remote.address"],
   "/routing rpki": ["address"],
@@ -5974,6 +6056,7 @@ var ORDER = [
   "/interface ethernet",
   "/interface bonding",
   "/interface vlan",
+  "/interface macvlan",
   "/interface gre",
   "/interface vxlan",
   "/interface wireguard",
@@ -6492,17 +6575,28 @@ function lags2(out, ctx) {
     }));
   }
 }
+var underMacvlan = (name) => `${name}-vlan`;
 function vlanInterfaces(out, ctx) {
   for (const [name, iface] of ctx.vlanInterfaces()) {
     const softwareOnly = ctx.device.hardware_offload && iface.hardware_offload === false;
+    const vlanName = iface.mac ? underMacvlan(name) : name;
     out.add("/interface vlan", command("add", {
       comment: iface.description,
       interface: BRIDGE,
       "l3-hw-offloading": softwareOnly ? "no" : undefined,
       mtu: iface.mtu,
-      name,
+      name: vlanName,
       "vlan-id": ctx.vlanId(iface.vlan)
     }));
+    if (iface.mac) {
+      out.add("/interface macvlan", command("add", {
+        comment: iface.description,
+        interface: vlanName,
+        "mac-address": iface.mac.toUpperCase(),
+        mtu: iface.mtu,
+        name
+      }));
+    }
   }
 }
 function tunnels(out, ctx) {
@@ -7448,6 +7542,10 @@ ${certificates}` : "";
 }
 function unsupported4(device) {
   const found = [];
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type === "bridge")
+      found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
+  }
   for (const [name, port] of Object.entries(device.ports ?? {})) {
     if (!port)
       continue;
@@ -8129,6 +8227,12 @@ function configurationOf(device, dump) {
 }
 function unsupported5(device) {
   const found = [];
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type === "bridge")
+      found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
+    if (iface.type === "vlan" && iface.mac)
+      found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
+  }
   for (const [name, port] of Object.entries(device.ports ?? {})) {
     if (!port)
       continue;
@@ -8935,6 +9039,20 @@ function checkInterfaces(device, names, report, ip) {
       if (!members.length)
         report(`LAG ${name} has no member ports`);
     }
+    if (iface.type === "bridge") {
+      if (iface.members.length < 2)
+        report(`bridge ${name} joins fewer than two interfaces`);
+      for (const member of iface.members) {
+        const joined = device.interfaces?.[member];
+        if (joined?.type !== "vlan")
+          report(`bridge ${name}: member ${member} is not a VLAN interface`);
+        else if (joined.addresses?.length)
+          report(`bridge ${name}: member ${member} has an address of its own`);
+        const others = Object.entries(device.interfaces ?? {}).filter(([other, settings]) => other !== name && settings.type === "bridge" && settings.members.includes(member));
+        if (others.length)
+          report(`bridge ${name}: member ${member} is also in bridge ${others[0][0]}`);
+      }
+    }
     if (iface.type === "wireguard") {
       for (const peer of iface.peers ?? []) {
         for (const address of peer.allowed_addresses) {

package/dist/presets/index.js

@@ -122,6 +122,7 @@ var vlansOf = (port) => [port.access_vlan, ...port.trunk_vlans ?? []].filter((vl
 var trustBoundary = (boundary) => (devices) => {
   const untrusted = new Set(boundary.untrusted);
   const routers = new Set(boundary.routers);
+  const extended = (a, b) => (boundary.extended ?? []).some(([x, y]) => x === a && y === b || x === b && y === a);
   const findings = [];
   for (const device of devices) {
     const isRouter = routers.has(device.name);
@@ -143,7 +144,8 @@ var trustBoundary = (boundary) => (devices) => {
     for (const { what, carried, faces } of carriers) {
       const mixes = carried.some((vlan) => untrusted.has(vlan)) && carried.some((vlan) => !untrusted.has(vlan));
       const facesRouter = isRouter || faces.some((name) => routers.has(name));
-      if (mixes && !facesRouter) {
+      const isExtension = faces.length > 0 && faces.every((name) => extended(device.name, name));
+      if (mixes && !facesRouter && !isExtension) {
         findings.push({
           level: "error",
           device: device.name,

package/dist/types/adapters/devices/fortios/firewall.d.ts

@@ -8,6 +8,8 @@ export declare function natRules(device: Device): NatRule<string, string>[];
 export declare function familiesOf(device: Device, match: FilterMatch<string, string> | undefined): Family[];
 /** A port or ports as the platform writes them in a service: `22`, `1000-2000`. */
 export declare function portList(ports: Ports | undefined): string[];
+/** Every protocol, as a service of Circuit's own, for a device in transparent mode. */
+export declare const ALL_IN_TRANSPARENT = "circuit-all";
 /** The service a rule matches, by name, with what it holds. `ALL` when the rule names no protocol and no port; ports without a protocol are TCP's and UDP's. */
 export declare function serviceOf(match: FilterMatch<string, string> | undefined, family: Family): {
     name: string;

package/dist/types/adapters/devices/fortios/index.d.ts

@@ -49,7 +49,7 @@ export type Guard = {
  * Send a plan line by line, each applied as it arrives. The device is first set to revert what is not saved, so a refused line or a fresh login that fails reloads its saved configuration. Once access is proved the change is saved, and changes save themselves again.
  */
 export declare function configure(cli: Cli, plan: Plan, guard: Guard): Promise<void>;
-export declare function apply(device: Device, _network: readonly Device[], plan: Plan, options: ApplyOptions): Promise<void>;
+export declare function apply(device: Device, network: readonly Device[], changes: Plan, options: ApplyOptions): Promise<void>;
 /** The lines that replace a prefix list's entries with what a registry returned: every entry is purged, then each prefix added, matching it and anything more specific. */
 export declare function fillLines(set: string, family: Family, prefixes: string[]): string[];
 /** Replace a prefix list `refresh` fetched. It cannot cut access, so it is sent without a guard, and saved as it goes. `purge` asks to confirm, and is answered yes. */

package/dist/types/adapters/devices/fortios/names.d.ts

@@ -7,6 +7,15 @@ type Addressed = {
     vrf?: string;
     lag?: string;
 };
+/** The bridges a device has, in the config's order. A device with any runs in transparent mode, each bridge a forward domain numbered by its place. */
+export declare function bridgesOf(device: Device): {
+    name: string;
+    members: readonly string[];
+}[];
+/** Whether the device runs in transparent mode: it has a bridge. */
+export declare const isTransparent: (device: Device) => boolean;
+/** The forward domain of a VLAN interface in a bridge, or undefined. */
+export declare function forwardDomainOf(device: Device, name: string): number | undefined;
 /** The name the platform gives a port or an interface: a port by its spelling, any other interface by its key. */
 export declare function nameOf(device: Device, name: string): string;
 /** A port's or an interface's settings, by its key. */

package/dist/types/adapters/devices/fortios/render.d.ts

@@ -31,6 +31,8 @@ export declare const LEVEL: Record<Severity, string>;
 export declare const HELPERS: Partial<Record<Helper, readonly [string, number, number][]>>;
 /** Speed by the platform's spelling, for each class a port's cage takes. */
 export declare const SPEEDS: Record<string, Partial<Record<string, string>>>;
+/** The management address of a device in transparent mode, which is reached only through its console: link-local, on no network it can reach. */
+export declare const TRANSPARENT_MANAGEIP = "169.254.0.1/255.255.255.255";
 export declare function render(device: Device): string;
 /** The one port or LAG that carries a VLAN tagged, which its VLAN interface sits on. `unsupported()` refuses any other case. */
 export declare function vlanParent(device: Device, vlan: string): string | undefined;

package/dist/types/adapters/devices/routeros/render.d.ts

@@ -64,6 +64,8 @@ export declare function renderInterfaces(out: Output, ctx: Context): void;
 type Speed = NonNullable<AnyPort["speed"]>;
 /** The platform's name for a fixed speed on a port, or undefined when it has none. */
 export declare function mediumOf(platformPortName: string, speed: Speed): string | undefined;
+/** The name of the VLAN interface under one with a MAC of its own, which takes the configured name itself. */
+export declare const underMacvlan: (name: string) => string;
 /** The interface holding one VRRP group. */
 export declare const vrrpName: (iface: string, id: number) => string;
 /**

package/dist/types/presets/index.d.ts

@@ -83,6 +83,10 @@ export type TrustBoundary = {
     untrusted: readonly string[];
     /** The devices that filter: the only ones that may give an untrusted VLAN an address, and the only ones a port carrying both kinds may face. */
     routers: readonly string[];
+    /**
+     * Links between two switches that may carry both kinds, each named by its two devices: a site's switch extended to another building, with an exchange's VLAN and its own management on one cable. Neither end gives an untrusted VLAN an address.
+     */
+    extended?: readonly (readonly [string, string])[];
 };
 /** A check: traffic from outside reaches your own VLANs only through a router. A port or LAG carrying an untrusted VLAN beside any other is on a router or faces one, and only a router gives an untrusted VLAN an address. */
 export declare const trustBoundary: (boundary: TrustBoundary) => Check;

package/dist/types/schema/interfaces.d.ts

@@ -114,6 +114,10 @@ export type VlanInterface<V extends string, F extends string> = Base<F> & {
     type: "vlan";
     /** The VLAN it is on. */
     vlan: V;
+    /**
+     * A MAC address of its own, instead of the one it shares with the device's other VLAN interfaces. A gateway in front of a transparent firewall needs one: frames to it come back on another VLAN, where the bridge would otherwise take a shared MAC for its own and keep them.
+     */
+    mac?: string;
 };
 /** An interface that is always up and is on no link, for addresses that must not depend on one. */
 export type Loopback<F extends string> = Base<F> & {
@@ -176,6 +180,14 @@ export type WireGuard<F extends string> = Base<F> & {
     /** Who may connect. */
     peers?: readonly WireGuardPeer[];
 };
+/**
+ * A layer 2 bridge between VLAN interfaces, each keeping its own VLAN: a frame that comes in on one member leaves another with that member's tag. A firewall filters what crosses it, by the rules of its forward chain between the members, without routing it.
+ */
+export type Bridge<F extends string> = Base<F> & {
+    type: "bridge";
+    /** The VLAN interfaces it joins, by name. Each has no address of its own. */
+    members: readonly string[];
+};
 /** Any interface that is not a physical port. */
-export type Interface<V extends string, F extends string> = VlanInterface<V, F> | Loopback<F> | Lag<V, F> | Gre<F> | Vxlan<F> | WireGuard<F>;
+export type Interface<V extends string, F extends string> = VlanInterface<V, F> | Loopback<F> | Lag<V, F> | Gre<F> | Vxlan<F> | WireGuard<F> | Bridge<F>;
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.29.0",
+    "version": "0.31.0",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",

package/src/adapters/devices/fortios/TRAPS.md

@@ -40,3 +40,6 @@ Behaviour that looks like something else. Each one has been hit on a FortiGate 3
 - The ports are `port1` to `port4` at 40G and `port5` to `port32` at 10G, then `mgmt1` and `mgmt2`. The factory dedicates both management ports to management and gives them addresses `192.168.1.99` and `192.168.2.99`.
 - On the serial console a line ends at a carriage return. A session left open stays logged in, and one left inside `config` stays there, so the next login must first leave and log out. The console takes 9600 bits per second: reading the sections Circuit manages takes about two minutes.
 - A data port can stay `netdev status: down`, with `rx_carrier: 0` in `diagnose hardware deviceinfo nic`, while the far end reads link-ok and frames reach the port's switch chip. Fixing the speed does not change it, in a LAG or out of one; a reboot does. `link_status: Up` there says nothing: a port with no cable shows it too.
+- Transparent mode, `set opmode transparent` under `config system settings`, refuses to start without a `manageip`: `Attribute 'manageip' MUST be set`. Switching to it takes every interface's address away, replaces the static routes with one default gateway, puts every port in one bridge, and deletes the factory's custom services, `ALL` among them, so a policy that names `ALL` is refused, `entry not found in datasource`. A link-local `manageip`, such as `169.254.0.1/255.255.255.255`, is accepted. It also adds an empty static route in each family and turns memory logging on, so an apply that switches the mode plans once more after it.
+- `forward-domain` exists only in transparent mode: in NAT mode it is `command parse error`. VLAN interfaces in the same forward domain are bridged, each frame leaving with the tag of the interface it leaves by.
+- Leaving transparent mode, `set opmode nat`, refuses `IP address must be a class A, B, or C ip` until an address is given with it.

package/src/adapters/devices/fortios/firewall.ts

@@ -2,7 +2,7 @@
 
 import { host } from "../../../core/addr";
 import type { AclRule, Device, Family, FilterMatch, FilterRule, NatRule, Ports, Protocol } from "../../../schema";
-import { familyOfPrefix, nameOf, network, subnet, withLength } from "./names";
+import { familyOfPrefix, isTransparent, nameOf, network, subnet, withLength } from "./names";
 import { Block, quote, quoteAll, UNSET } from "./tree";
 
 /** IP protocol numbers, for a protocol the platform names only by number. */
@@ -51,6 +51,9 @@ export function portList(ports: Ports | undefined): string[] {
     return list.map((port) => (typeof port === "number" ? String(port) : `${port.min}-${port.max}`));
 }
 
+/** Every protocol, as a service of Circuit's own, for a device in transparent mode. */
+export const ALL_IN_TRANSPARENT = "circuit-all";
+
 /** The service a rule matches, by name, with what it holds. `ALL` when the rule names no protocol and no port; ports without a protocol are TCP's and UDP's. */
 export function serviceOf(match: FilterMatch<string, string> | undefined, family: Family): { name: string; block?: Block } {
     const protocol = match?.protocol;
@@ -134,6 +137,13 @@ class Objects {
 
     service(match: FilterMatch<string, string> | undefined, family: Family): string {
         const { name, block } = serviceOf(match, family);
+
+        // Transparent mode deletes the factory's services, `ALL` with them, so every protocol is a service of Circuit's own there.
+        if (name === "ALL" && isTransparent(this.device)) {
+            this.root.block("firewall service custom").entry(ALL_IN_TRANSPARENT).set("protocol", "IP");
+            return ALL_IN_TRANSPARENT;
+        }
+
         if (!block) return name;
 
         const entry = this.root.block("firewall service custom").entry(name);

package/src/adapters/devices/fortios/index.ts

@@ -11,7 +11,7 @@ import { connect, managementHost, shell } from "../../../transport/ssh";
 import { portsOf, spell } from "../catalog";
 import type { ApplyOptions, DeviceAdapter, Plan, ReadOptions } from "../types";
 import { acceptsBeforeDrop, familiesOf, isImplied, serviceOf } from "./firewall";
-import { holderOf, interfaceFor, network, settingsOf, subnet } from "./names";
+import { holderOf, interfaceFor, isTransparent, network, settingsOf, subnet } from "./names";
 import { clean, plan } from "./plan";
 import { COLLECTORS, FULL, HELPERS, RESOLVERS, render, SECTIONS, SPEEDS, SSH_KEYS, vlanParent, VRFS, zoneOf } from "./render";
 import { BITS, PREFIX_LIST, routingGaps } from "./routing";
@@ -376,7 +376,21 @@ async function settle(device: Device, options: ReadOptions): Promise<string> {
     return "the device did not come back in time and still reverts every change; set `cfg-save automatic` under `config system global`";
 }
 
-export async function apply(device: Device, _network: readonly Device[], plan: Plan, options: ApplyOptions): Promise<void> {
+export async function apply(device: Device, network: readonly Device[], changes: Plan, options: ApplyOptions): Promise<void> {
+    await applyOnce(device, changes, options);
+
+    // Switching the operation mode makes changes of its own, such as a static route in each family and memory logging on, which a plan made before it could not see. One more pass, planned against what the device now runs, takes them back.
+    const switched = changes.steps.some((step) => step.send.some((line) => line.startsWith("set opmode ")));
+    if (!switched) return;
+
+    const again = plan(render(device), await read(device, network, options), options);
+    if (!again.steps.length) return;
+
+    console.log("  the operation mode changed; applying what it added on its own");
+    await applyOnce(device, again, options);
+}
+
+async function applyOnce(device: Device, plan: Plan, options: ApplyOptions): Promise<void> {
     const seconds = options.rollback * 60;
 
     try {
@@ -454,6 +468,11 @@ export function unsupported(device: Device): string[] {
     found.push(...serviceGaps(device));
 
     if (device.stp) found.push("stp, ports are routed");
+    found.push(...transparentGaps(device));
+
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+        if (iface.type === "vlan" && iface.mac) found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
+    }
     if (Object.keys(device.vrfs ?? {}).length > VRFS) found.push(`vrfs, at most ${VRFS}`);
 
     for (const [name, vrf] of Object.entries(device.vrfs ?? {})) {
@@ -463,6 +482,35 @@ export function unsupported(device: Device): string[] {
     return found;
 }
 
+/** What transparent mode, which a bridge needs, leaves out: every address, routing, NAT and the services that answer on an address. The device is reached through its console. */
+function transparentGaps(device: Device): string[] {
+    if (!isTransparent(device)) return [];
+
+    const found: string[] = [];
+    const where = "in transparent mode, which a bridge needs";
+
+    if (device.connection.host) found.push(`connection.host, ${where}: the device is reached through its console`);
+
+    for (const [name, port] of Object.entries(device.ports ?? {})) {
+        if (port?.addresses?.length) found.push(`ports.${name}.addresses, ${where}`);
+    }
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+        if (iface.addresses?.length) found.push(`interfaces.${name}.addresses, ${where}`);
+    }
+
+    const routing = device.routing;
+    if (routing?.static?.length || routing?.bgp || routing?.ospf) found.push(`routing, ${where}`);
+    if (device.firewall?.nat) found.push(`firewall.nat, ${where}`);
+    if (device.dhcp && Object.keys(device.dhcp).length) found.push(`dhcp, ${where}`);
+
+    const management = device.management ?? {};
+    for (const service of ["ssh", "telnet", "http", "https", "api", "api_tls", "snmp", "native"] as const) {
+        if (management[service]) found.push(`management.${service}, ${where}: the device has no address to answer on`);
+    }
+
+    return found;
+}
+
 function systemGaps(device: Device): string[] {
     const found: string[] = [];
     const system = device.system ?? {};

package/src/adapters/devices/fortios/names.ts

@@ -6,6 +6,22 @@ import { spell } from "../catalog";
 
 type Addressed = { addresses?: readonly (string | { address: string; peer?: string })[]; vrf?: string; lag?: string };
 
+/** The bridges a device has, in the config's order. A device with any runs in transparent mode, each bridge a forward domain numbered by its place. */
+export function bridgesOf(device: Device): { name: string; members: readonly string[] }[] {
+    return Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) =>
+        iface.type === "bridge" ? [{ name, members: iface.members }] : []
+    );
+}
+
+/** Whether the device runs in transparent mode: it has a bridge. */
+export const isTransparent = (device: Device) => bridgesOf(device).length > 0;
+
+/** The forward domain of a VLAN interface in a bridge, or undefined. */
+export function forwardDomainOf(device: Device, name: string): number | undefined {
+    const index = bridgesOf(device).findIndex((bridge) => bridge.members.includes(name));
+    return index < 0 ? undefined : index + 1;
+}
+
 /** The name the platform gives a port or an interface: a port by its spelling, any other interface by its key. */
 export function nameOf(device: Device, name: string): string {
     if (device.interfaces && name in device.interfaces) return name;

package/src/adapters/devices/fortios/plan.ts

@@ -805,7 +805,16 @@ export function plan(desired: string, current: string, options: Pick<ApplyOption
         }
     }
 
-    return { steps: [...first, ...steps, ...removals, ...late], problems: [] };
+    // Leaving transparent mode needs an address and an interface for it, which the config of a device without a bridge does not say.
+    const opmode = (root: Block) => root.blocks.get("system settings")?.settings.get("opmode");
+    const problems =
+        opmode(have) === "transparent" && opmode(want) !== "transparent"
+            ? [
+                  "the device runs in transparent mode and the config has no bridge; leave transparent mode by hand, `set opmode nat` with an address and an interface under `config system settings`, then plan again",
+              ]
+            : [];
+
+    return { steps: [...first, ...steps, ...removals, ...late], problems };
 }
 
 /** The interfaces of tunnels, which their own tables create, compared after those tables as a section of their own. */

package/src/adapters/devices/fortios/render.ts

@@ -5,7 +5,18 @@ import { marker } from "../../../core/secrets";
 import type { Device, Helper, Severity } from "../../../schema";
 import { portsOf, spell } from "../catalog";
 import { firewall, natRules } from "./firewall";
-import { addressed, addressesOf, holderOf, interfaceFor, nameOf, network, subnet, vrfNumber } from "./names";
+import {
+    addressed,
+    addressesOf,
+    forwardDomainOf,
+    holderOf,
+    interfaceFor,
+    isTransparent,
+    nameOf,
+    network,
+    subnet,
+    vrfNumber,
+} from "./names";
 import { routing, usesBfd } from "./routing";
 import { Block, print, quote, quoteAll } from "./tree";
 
@@ -246,6 +257,9 @@ function allowAccess(device: Device): string {
     return services.join(" ");
 }
 
+/** The management address of a device in transparent mode, which is reached only through its console: link-local, on no network it can reach. */
+export const TRANSPARENT_MANAGEIP = "169.254.0.1/255.255.255.255";
+
 export function render(device: Device): string {
     const root = new Block();
     for (const section of SECTIONS) root.block(section);
@@ -255,6 +269,8 @@ export function render(device: Device): string {
     certificates(section("vpn certificate local"), section("vpn certificate ca"), device);
     global(section("system global"), device);
     if (device.system?.banner) section(BANNER).set("buffer", quote(device.system.banner));
+    // A bridge needs transparent mode, and transparent mode a management address. One on no network the device can reach keeps it reached only through its console.
+    if (isTransparent(device)) section("system settings").set("opmode", "transparent").set("manageip", TRANSPARENT_MANAGEIP);
     if (natRules(device).length) section("system settings").set("central-nat", "enable");
     // SIP is otherwise rewritten by its proxy whatever the helpers say; this way only the `sip` helper does.
     section("system settings").set("default-voip-alg-mode", "kernel-helper-based");
@@ -391,6 +407,8 @@ function interfaces(root: Block, device: Device): void {
         entry.set("vdom", quote("root"));
         if (parent) entry.set("interface", quote(nameOf(device, parent)));
         entry.set("vlanid", device.vlans?.[iface.vlan]?.id ?? 0);
+        const domain = forwardDomainOf(device, name);
+        if (domain) entry.set("forward-domain", domain);
         if (iface.description) entry.set("description", quote(iface.description));
         if (iface.mtu) entry.set("mtu-override", "enable").set("mtu", iface.mtu);
         redirects(entry, device);

package/src/adapters/devices/junos/index.ts

@@ -565,6 +565,11 @@ export async function apply(device: Device, _network: readonly Device[], plan: P
 
 export function unsupported(device: Device): string[] {
     const found: string[] = [];
+
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+        if (iface.type === "bridge") found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
+        if (iface.type === "vlan" && iface.mac) found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
+    }
     const names = new Names(device);
     const users = device.users ?? {};
 

package/src/adapters/devices/raisecom-ros/index.ts

@@ -420,6 +420,11 @@ export async function read(device: Device, _network: readonly Device[] = [], opt
 export function unsupported(device: Device): string[] {
     const found: string[] = [];
 
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+        if (iface.type === "bridge") found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
+        if (iface.type === "vlan" && iface.mac) found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
+    }
+
     for (const [name, port] of Object.entries(device.ports ?? {})) {
         if (!port) continue;
 

package/src/adapters/devices/routeros/TRAPS.md

@@ -42,3 +42,5 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - `:parse` checks the command, not the text inside `rule=`. A routing filter rule is only checked when it is added.
 - `/routing/filter/filter-wizard` adds the rule it builds; it is not a dry run. `set blackhole yes` was proved this way on 7.23, in an unused chain removed right after.
 - On the serial console, the prompt can come twice after a login. The console echoes a long command wrapped at 80 columns, and a `print` that fills the screen stops at `-- [Q quit|D dump|down]`, where `D` prints the rest.
+- Every VLAN interface on the bridge has the bridge's MAC, and the bridge keeps a frame to that MAC on whatever VLAN it arrives. A gateway in front of a transparent firewall then never gets its replies: they come back on the inside VLAN and stop at the bridge. A MACVLAN on the VLAN interface gives the gateway a MAC of its own, and its replies cross the firewall back; proved with a FortiGate 3700D in transparent mode, the session offloaded to its NP6.
+- A second VLAN interface with the same VLAN ID on the same interface is refused, `already have such vlan`, so a VLAN interface is known by its interface and VLAN ID, and a new name is a rename.

package/src/adapters/devices/routeros/export.ts

@@ -131,6 +131,7 @@ export const DEFAULTS: Record<string, Record<string, string>> = {
         "limit-unknown-unicasts": "no",
     },
     "/interface vlan": { "l3-hw-offloading": "yes", mtu: "1500" },
+    "/interface macvlan": { mode: "bridge", mtu: "1500" },
     "/interface vrrp": { priority: "100", "preemption-mode": "yes", interval: "1s", version: "3", "v3-protocol": "ipv4" },
     "/interface vxlan": { port: "4789" },
     "/interface wireguard peers": {
@@ -259,6 +260,8 @@ const IDENTITY: Record<string, string[]> = {
     "/ipv6 firewall address-list": ["list", "address"],
     "/interface bridge port": ["interface"],
     "/interface bridge vlan": ["vlan-ids"],
+    // One VLAN ID per interface: the device refuses a second, so a rename, such as one a MAC of its own brings, is a rename.
+    "/interface vlan": ["interface", "vlan-id"],
     "/interface vxlan vteps": ["interface", "remote-ip"],
     "/routing bgp connection": ["remote.address"],
     "/routing rpki": ["address"],

package/src/adapters/devices/routeros/index.ts

@@ -151,6 +151,10 @@ export async function read(device: Device, _network: readonly Device[] = [], opt
 export function unsupported(device: Device): string[] {
     const found: string[] = [];
 
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+        if (iface.type === "bridge") found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
+    }
+
     for (const [name, port] of Object.entries(device.ports ?? {})) {
         if (!port) continue;
 

package/src/adapters/devices/routeros/plan.ts

@@ -16,6 +16,7 @@ const ORDER = [
     "/interface ethernet",
     "/interface bonding",
     "/interface vlan",
+    "/interface macvlan",
     "/interface gre",
     "/interface vxlan",
     "/interface wireguard",

package/src/adapters/devices/routeros/render.ts

@@ -344,10 +344,19 @@ function lags(out: Output, ctx: Context): void {
     }
 }
 
-/** A VLAN interface sits on the bridge. When the device offloads, one that opts out is routed in software so the firewall applies. */
+/** The name of the VLAN interface under one with a MAC of its own, which takes the configured name itself. */
+export const underMacvlan = (name: string) => `${name}-vlan`;
+
+/**
+ * A VLAN interface sits on the bridge. When the device offloads, one that opts out is routed in software so the firewall applies.
+ *
+ * Every VLAN interface on the bridge has the bridge's MAC. One with a MAC of its own is a MACVLAN on top of the VLAN interface: the MACVLAN takes the configured name, so its addresses and every rule naming it land on it.
+ */
 function vlanInterfaces(out: Output, ctx: Context): void {
     for (const [name, iface] of ctx.vlanInterfaces()) {
         const softwareOnly = ctx.device.hardware_offload && iface.hardware_offload === false;
+        const vlanName = iface.mac ? underMacvlan(name) : name;
+
         out.add(
             "/interface vlan",
             command("add", {
@@ -355,10 +364,23 @@ function vlanInterfaces(out: Output, ctx: Context): void {
                 interface: BRIDGE,
                 "l3-hw-offloading": softwareOnly ? "no" : undefined,
                 mtu: iface.mtu,
-                name,
+                name: vlanName,
                 "vlan-id": ctx.vlanId(iface.vlan),
             })
         );
+
+        if (iface.mac) {
+            out.add(
+                "/interface macvlan",
+                command("add", {
+                    comment: iface.description,
+                    interface: vlanName,
+                    "mac-address": iface.mac.toUpperCase(),
+                    mtu: iface.mtu,
+                    name,
+                })
+            );
+        }
     }
 }
 

package/src/adapters/devices/vrp/index.ts

@@ -637,6 +637,11 @@ function configurationOf(device: Device, dump: string): string {
 export function unsupported(device: Device): string[] {
     const found: string[] = [];
 
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+        if (iface.type === "bridge") found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
+        if (iface.type === "vlan" && iface.mac) found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
+    }
+
     for (const [name, port] of Object.entries(device.ports ?? {})) {
         if (!port) continue;
 

package/src/core/validate.ts

@@ -175,6 +175,21 @@ function checkInterfaces(device: Device, names: Names, report: Report, ip: Check
             if (!members.length) report(`LAG ${name} has no member ports`);
         }
 
+        if (iface.type === "bridge") {
+            if (iface.members.length < 2) report(`bridge ${name} joins fewer than two interfaces`);
+
+            for (const member of iface.members) {
+                const joined = device.interfaces?.[member];
+                if (joined?.type !== "vlan") report(`bridge ${name}: member ${member} is not a VLAN interface`);
+                else if (joined.addresses?.length) report(`bridge ${name}: member ${member} has an address of its own`);
+
+                const others = Object.entries(device.interfaces ?? {}).filter(
+                    ([other, settings]) => other !== name && settings.type === "bridge" && settings.members.includes(member)
+                );
+                if (others.length) report(`bridge ${name}: member ${member} is also in bridge ${others[0]![0]}`);
+            }
+        }
+
         if (iface.type === "wireguard") {
             for (const peer of iface.peers ?? []) {
                 for (const address of peer.allowed_addresses) {

package/src/presets/index.ts

@@ -186,6 +186,10 @@ export type TrustBoundary = {
     untrusted: readonly string[];
     /** The devices that filter: the only ones that may give an untrusted VLAN an address, and the only ones a port carrying both kinds may face. */
     routers: readonly string[];
+    /**
+     * Links between two switches that may carry both kinds, each named by its two devices: a site's switch extended to another building, with an exchange's VLAN and its own management on one cable. Neither end gives an untrusted VLAN an address.
+     */
+    extended?: readonly (readonly [string, string])[];
 };
 
 /** A check: traffic from outside reaches your own VLANs only through a router. A port or LAG carrying an untrusted VLAN beside any other is on a router or faces one, and only a router gives an untrusted VLAN an address. */
@@ -194,6 +198,7 @@ export const trustBoundary =
     (devices) => {
         const untrusted = new Set(boundary.untrusted);
         const routers = new Set(boundary.routers);
+        const extended = (a: string, b: string) => (boundary.extended ?? []).some(([x, y]) => (x === a && y === b) || (x === b && y === a));
         const findings: Finding[] = [];
 
         for (const device of devices) {
@@ -225,8 +230,9 @@ export const trustBoundary =
             for (const { what, carried, faces } of carriers) {
                 const mixes = carried.some((vlan) => untrusted.has(vlan)) && carried.some((vlan) => !untrusted.has(vlan));
                 const facesRouter = isRouter || faces.some((name) => routers.has(name));
+                const isExtension = faces.length > 0 && faces.every((name) => extended(device.name, name));
 
-                if (mixes && !facesRouter) {
+                if (mixes && !facesRouter && !isExtension) {
                     findings.push({
                         level: "error",
                         device: device.name,

package/src/schema/interfaces.ts

@@ -119,6 +119,10 @@ export type VlanInterface<V extends string, F extends string> = Base<F> & {
     type: "vlan";
     /** The VLAN it is on. */
     vlan: V;
+    /**
+     * A MAC address of its own, instead of the one it shares with the device's other VLAN interfaces. A gateway in front of a transparent firewall needs one: frames to it come back on another VLAN, where the bridge would otherwise take a shared MAC for its own and keep them.
+     */
+    mac?: string;
 };
 
 /** An interface that is always up and is on no link, for addresses that must not depend on one. */
@@ -187,6 +191,15 @@ export type WireGuard<F extends string> = Base<F> & {
     peers?: readonly WireGuardPeer[];
 };
 
+/**
+ * A layer 2 bridge between VLAN interfaces, each keeping its own VLAN: a frame that comes in on one member leaves another with that member's tag. A firewall filters what crosses it, by the rules of its forward chain between the members, without routing it.
+ */
+export type Bridge<F extends string> = Base<F> & {
+    type: "bridge";
+    /** The VLAN interfaces it joins, by name. Each has no address of its own. */
+    members: readonly string[];
+};
+
 /** Any interface that is not a physical port. */
 export type Interface<V extends string, F extends string> =
-    VlanInterface<V, F> | Loopback<F> | Lag<V, F> | Gre<F> | Vxlan<F> | WireGuard<F>;
+    VlanInterface<V, F> | Loopback<F> | Lag<V, F> | Gre<F> | Vxlan<F> | WireGuard<F> | Bridge<F>;