@takodotid/circuit 0.32.0 → 0.33.0

package/dist/cli/index.js

@@ -545,6 +545,20 @@ function bridgesOf(device) {
   return Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) => iface.type === "bridge" ? [{ name, members: iface.members }] : []);
 }
 var isTransparent = (device) => bridgesOf(device).length > 0;
+function transparentManagement(device) {
+  if (!isTransparent(device))
+    return;
+  const members = new Set(bridgesOf(device).flatMap((bridge) => bridge.members));
+  const holders = [...Object.entries(device.ports ?? {}), ...Object.entries(device.interfaces ?? {})];
+  for (const [name, settings] of holders) {
+    if (members.has(name))
+      continue;
+    const address = addressesOf2(settings).find((each) => familyOf2(host2(each)) === "ipv4");
+    if (address)
+      return { name, address };
+  }
+  return;
+}
 function forwardDomainOf(device, name) {
   const index = bridgesOf(device).findIndex((bridge) => bridge.members.includes(name));
   return index < 0 ? undefined : index + 1;
@@ -2232,8 +2246,11 @@ function render(device) {
   global(section("system global"), device);
   if (device.system?.banner)
     section(BANNER).set("buffer", quote(device.system.banner));
-  if (isTransparent(device))
-    section("system settings").set("opmode", "transparent").set("manageip", TRANSPARENT_MANAGEIP);
+  if (isTransparent(device)) {
+    const management = transparentManagement(device);
+    const manageip = management ? `${host2(management.address)}/${netmask(split(management.address).len)}` : TRANSPARENT_MANAGEIP;
+    section("system settings").set("opmode", "transparent").set("manageip", manageip);
+  }
   if (natRules(device).length)
     section("system settings").set("central-nat", "enable");
   section("system settings").set("default-voip-alg-mode", "kernel-helper-based");
@@ -2428,6 +2445,11 @@ function vlanParent(device, vlan) {
   return carriers.length === 1 ? carriers[0][0] : undefined;
 }
 function routed(entry, device, name, settings, access) {
+  if (isTransparent(device)) {
+    if (transparentManagement(device)?.name === name)
+      entry.set("allowaccess", access);
+    return;
+  }
   const addresses = addressesOf2(settings);
   const ipv4 = addresses.filter((address) => familyOf2(host2(address)) === "ipv4");
   const ipv6 = addresses.filter((address) => familyOf2(host2(address)) === "ipv6");
@@ -2634,7 +2656,7 @@ function staticRoutes(ipv4, ipv6, device) {
     if (route.via)
       entry.set("gateway", route.via);
     const outgoing = route.interface ?? (route.via ? interfaceFor(device, route.via, route.vrf) : undefined);
-    if (outgoing && !route.blackhole)
+    if (outgoing && !route.blackhole && !isTransparent(device))
       entry.set("device", quote(nameOf(device, outgoing)));
     if (route.distance !== undefined && route.distance !== 10)
       entry.set("distance", route.distance);
@@ -3027,27 +3049,38 @@ function transparentGaps(device) {
     return [];
   const found = [];
   const where = "in transparent mode, which a bridge needs";
-  if (device.connection.host)
-    found.push(`connection.host, ${where}: the device is reached through its console`);
-  for (const [name, port] of Object.entries(device.ports ?? {})) {
-    if (port?.addresses?.length)
-      found.push(`ports.${name}.addresses, ${where}`);
-  }
-  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-    if (iface.addresses?.length)
-      found.push(`interfaces.${name}.addresses, ${where}`);
+  const management = transparentManagement(device);
+  if (device.connection.host && device.connection.host !== (management && host2(management.address)))
+    found.push(`connection.host, ${where}: only the management address, one IPv4 address outside the bridges`);
+  const holders = [
+    ...Object.entries(device.ports ?? {}).map(([name, port]) => [`ports.${name}`, name, port?.addresses]),
+    ...Object.entries(device.interfaces ?? {}).map(([name, iface]) => [`interfaces.${name}`, name, iface.addresses])
+  ];
+  for (const [path, name, addresses] of holders) {
+    const extra = (addresses ?? []).filter((entry) => !(typeof entry === "string" && management && name === management.name && entry === management.address));
+    if (extra.length)
+      found.push(`${path}.addresses, ${where}: one IPv4 address in all, outside the bridges, for management`);
   }
   const routing = device.routing;
-  if (routing?.static?.length || routing?.bgp || routing?.ospf)
-    found.push(`routing, ${where}`);
+  if (routing?.bgp || routing?.ospf)
+    found.push(`routing, ${where}: static routes only`);
+  for (const [index, route] of (routing?.static ?? []).entries()) {
+    const at = `routing.static[${index}]`;
+    if (!management)
+      found.push(`${at}, ${where}: a route needs the management address`);
+    if (!route.via || familyOf2(route.via) !== "ipv4" || route.interface || route.blackhole || route.vrf)
+      found.push(`${at}, ${where}: only an IPv4 next hop, for the management address`);
+  }
   if (device.firewall?.nat)
     found.push(`firewall.nat, ${where}`);
   if (device.dhcp && Object.keys(device.dhcp).length)
     found.push(`dhcp, ${where}`);
-  const management = device.management ?? {};
-  for (const service of ["ssh", "telnet", "http", "https", "api", "api_tls", "snmp", "native"]) {
-    if (management[service])
-      found.push(`management.${service}, ${where}: the device has no address to answer on`);
+  if (!management) {
+    const services = device.management ?? {};
+    for (const service of ["ssh", "telnet", "http", "https", "api", "api_tls", "snmp", "native"]) {
+      if (services[service])
+        found.push(`management.${service}, ${where}: the device has no management address to answer on`);
+    }
   }
   return found;
 }

package/dist/types/adapters/devices/fortios/names.d.ts

@@ -14,6 +14,13 @@ export declare function bridgesOf(device: Device): {
 }[];
 /** Whether the device runs in transparent mode: it has a bridge. */
 export declare const isTransparent: (device: Device) => boolean;
+/**
+ * The management address of a device in transparent mode: the one IPv4 address on a port or an interface outside every bridge. The device answers on it, the platform's `manageip`, through that interface alone. Undefined when there is none, and the device is reached only through its console.
+ */
+export declare function transparentManagement(device: Device): {
+    name: string;
+    address: string;
+} | undefined;
 /** The forward domain of a VLAN interface in a bridge, or undefined. */
 export declare function forwardDomainOf(device: Device, name: string): number | undefined;
 /** The name the platform gives a port or an interface: a port by its spelling, any other interface by its key. */

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.32.0",
+    "version": "0.33.0",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",

package/src/adapters/devices/fortios/index.ts

@@ -11,7 +11,7 @@ import { connect, managementHost, shell } from "../../../transport/ssh";
 import { portsOf, spell } from "../catalog";
 import type { ApplyOptions, DeviceAdapter, Plan, ReadOptions } from "../types";
 import { acceptsBeforeDrop, familiesOf, isImplied, serviceOf } from "./firewall";
-import { holderOf, interfaceFor, isTransparent, network, settingsOf, subnet } from "./names";
+import { holderOf, interfaceFor, isTransparent, network, settingsOf, subnet, transparentManagement } from "./names";
 import { clean, plan } from "./plan";
 import { COLLECTORS, FULL, HELPERS, RESOLVERS, render, SECTIONS, SPEEDS, SSH_KEYS, vlanParent, VRFS, zoneOf } from "./render";
 import { BITS, PREFIX_LIST, routingGaps } from "./routing";
@@ -482,30 +482,49 @@ export function unsupported(device: Device): string[] {
     return found;
 }
 
-/** What transparent mode, which a bridge needs, leaves out: every address, routing, NAT and the services that answer on an address. The device is reached through its console. */
+/**
+ * What transparent mode, which a bridge needs, leaves out: every address but one IPv4 management address outside the bridges, routing beyond static routes for it, NAT and DHCP. Without a management address the device is reached through its console and answers no service.
+ */
 function transparentGaps(device: Device): string[] {
     if (!isTransparent(device)) return [];
 
     const found: string[] = [];
     const where = "in transparent mode, which a bridge needs";
+    const management = transparentManagement(device);
 
-    if (device.connection.host) found.push(`connection.host, ${where}: the device is reached through its console`);
+    if (device.connection.host && device.connection.host !== (management && host(management.address)))
+        found.push(`connection.host, ${where}: only the management address, one IPv4 address outside the bridges`);
 
-    for (const [name, port] of Object.entries(device.ports ?? {})) {
-        if (port?.addresses?.length) found.push(`ports.${name}.addresses, ${where}`);
-    }
-    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-        if (iface.addresses?.length) found.push(`interfaces.${name}.addresses, ${where}`);
+    const holders = [
+        ...Object.entries(device.ports ?? {}).map(([name, port]) => [`ports.${name}`, name, port?.addresses] as const),
+        ...Object.entries(device.interfaces ?? {}).map(([name, iface]) => [`interfaces.${name}`, name, iface.addresses] as const),
+    ];
+
+    for (const [path, name, addresses] of holders) {
+        const extra = (addresses ?? []).filter(
+            (entry) => !(typeof entry === "string" && management && name === management.name && entry === management.address)
+        );
+        if (extra.length) found.push(`${path}.addresses, ${where}: one IPv4 address in all, outside the bridges, for management`);
     }
 
     const routing = device.routing;
-    if (routing?.static?.length || routing?.bgp || routing?.ospf) found.push(`routing, ${where}`);
+    if (routing?.bgp || routing?.ospf) found.push(`routing, ${where}: static routes only`);
+
+    for (const [index, route] of (routing?.static ?? []).entries()) {
+        const at = `routing.static[${index}]`;
+        if (!management) found.push(`${at}, ${where}: a route needs the management address`);
+        if (!route.via || familyOf(route.via) !== "ipv4" || route.interface || route.blackhole || route.vrf)
+            found.push(`${at}, ${where}: only an IPv4 next hop, for the management address`);
+    }
+
     if (device.firewall?.nat) found.push(`firewall.nat, ${where}`);
     if (device.dhcp && Object.keys(device.dhcp).length) found.push(`dhcp, ${where}`);
 
-    const management = device.management ?? {};
-    for (const service of ["ssh", "telnet", "http", "https", "api", "api_tls", "snmp", "native"] as const) {
-        if (management[service]) found.push(`management.${service}, ${where}: the device has no address to answer on`);
+    if (!management) {
+        const services = device.management ?? {};
+        for (const service of ["ssh", "telnet", "http", "https", "api", "api_tls", "snmp", "native"] as const) {
+            if (services[service]) found.push(`management.${service}, ${where}: the device has no management address to answer on`);
+        }
     }
 
     return found;

package/src/adapters/devices/fortios/names.ts

@@ -16,6 +16,27 @@ export function bridgesOf(device: Device): { name: string; members: readonly str
 /** Whether the device runs in transparent mode: it has a bridge. */
 export const isTransparent = (device: Device) => bridgesOf(device).length > 0;
 
+/**
+ * The management address of a device in transparent mode: the one IPv4 address on a port or an interface outside every bridge. The device answers on it, the platform's `manageip`, through that interface alone. Undefined when there is none, and the device is reached only through its console.
+ */
+export function transparentManagement(device: Device): { name: string; address: string } | undefined {
+    if (!isTransparent(device)) return undefined;
+
+    const members = new Set(bridgesOf(device).flatMap((bridge) => bridge.members));
+    const holders = [...Object.entries(device.ports ?? {}), ...Object.entries(device.interfaces ?? {})] as [
+        string,
+        Addressed | undefined,
+    ][];
+
+    for (const [name, settings] of holders) {
+        if (members.has(name)) continue;
+        const address = addressesOf(settings).find((each) => familyOf(host(each)) === "ipv4");
+        if (address) return { name, address };
+    }
+
+    return undefined;
+}
+
 /** The forward domain of a VLAN interface in a bridge, or undefined. */
 export function forwardDomainOf(device: Device, name: string): number | undefined {
     const index = bridgesOf(device).findIndex((bridge) => bridge.members.includes(name));

package/src/adapters/devices/fortios/render.ts

@@ -15,6 +15,7 @@ import {
     nameOf,
     network,
     subnet,
+    transparentManagement,
     vrfNumber,
 } from "./names";
 import { routing, usesBfd } from "./routing";
@@ -269,8 +270,12 @@ export function render(device: Device): string {
     certificates(section("vpn certificate local"), section("vpn certificate ca"), device);
     global(section("system global"), device);
     if (device.system?.banner) section(BANNER).set("buffer", quote(device.system.banner));
-    // A bridge needs transparent mode, and transparent mode a management address. One on no network the device can reach keeps it reached only through its console.
-    if (isTransparent(device)) section("system settings").set("opmode", "transparent").set("manageip", TRANSPARENT_MANAGEIP);
+    // A bridge needs transparent mode, and transparent mode a management address: the config's, or one on no network the device can reach, which keeps it reached only through its console.
+    if (isTransparent(device)) {
+        const management = transparentManagement(device);
+        const manageip = management ? `${host(management.address)}/${netmask(split(management.address).len)}` : TRANSPARENT_MANAGEIP;
+        section("system settings").set("opmode", "transparent").set("manageip", manageip);
+    }
     if (natRules(device).length) section("system settings").set("central-nat", "enable");
     // SIP is otherwise rewritten by its proxy whatever the helpers say; this way only the `sip` helper does.
     section("system settings").set("default-voip-alg-mode", "kernel-helper-based");
@@ -484,6 +489,12 @@ type RoutedSettings = {
 
 /** Addresses and their routing table, the services answered on them, VRRP, DHCP relay, router advertisements, LLDP and flow sampling of a port or an interface. */
 function routed(entry: Block, device: Device, name: string, settings: RoutedSettings, access: string): void {
+    // In transparent mode no interface holds an address: the management address is the device's, and answers on its interface alone.
+    if (isTransparent(device)) {
+        if (transparentManagement(device)?.name === name) entry.set("allowaccess", access);
+        return;
+    }
+
     const addresses = addressesOf(settings);
     const ipv4 = addresses.filter((address) => familyOf(host(address)) === "ipv4");
     const ipv6 = addresses.filter((address) => familyOf(host(address)) === "ipv6");
@@ -732,8 +743,9 @@ function staticRoutes(ipv4: Block, ipv6: Block, device: Device): void {
 
         if (route.via) entry.set("gateway", route.via);
 
+        // In transparent mode a route names no interface: it carries only the management address's own traffic.
         const outgoing = route.interface ?? (route.via ? interfaceFor(device, route.via, route.vrf) : undefined);
-        if (outgoing && !route.blackhole) entry.set("device", quote(nameOf(device, outgoing)));
+        if (outgoing && !route.blackhole && !isTransparent(device)) entry.set("device", quote(nameOf(device, outgoing)));
 
         if (route.distance !== undefined && route.distance !== 10) entry.set("distance", route.distance);
         if (route.description) entry.set("comment", quote(route.description));