@takodotid/circuit 0.33.0 → 0.34.0

package/dist/cli/index.js

@@ -2450,6 +2450,9 @@ function routed(entry, device, name, settings, access) {
       entry.set("allowaccess", access);
     return;
   }
+  const answering = device.management?.interfaces;
+  if (answering && !answering.includes(name))
+    access = "ping";
   const addresses = addressesOf2(settings);
   const ipv4 = addresses.filter((address) => familyOf2(host2(address)) === "ipv4");
   const ipv6 = addresses.filter((address) => familyOf2(host2(address)) === "ipv6");
@@ -4890,6 +4893,8 @@ function unsupported2(device) {
   }
   if (management.console)
     found.push("management.console, the console uses the device's users");
+  if (management.interfaces)
+    found.push("management.interfaces, which only FortiOS builds for now");
   if (management.native?.interfaces?.length)
     found.push("management.native.interfaces, NETCONF runs over IP only");
   if (management.ssh?.auth_timeout || management.ssh?.auth_retries)
@@ -5613,6 +5618,8 @@ async function read3(device, _network = [], options = {}) {
 }
 function unsupported3(device) {
   const found = [];
+  if (device.management?.interfaces)
+    found.push("management.interfaces, which only FortiOS builds for now");
   for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
     if (iface.type === "bridge")
       found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
@@ -7624,6 +7631,8 @@ function unsupported4(device) {
   const management = device.management;
   if (management?.console)
     found.push("management.console, the console uses the device's users");
+  if (management?.interfaces)
+    found.push("management.interfaces, which only FortiOS builds for now");
   if (management?.privilege_password)
     found.push("management.privilege_password, the platform has no privileged mode");
   if (management?.snmp?.port)
@@ -8276,6 +8285,8 @@ function configurationOf(device, dump) {
 }
 function unsupported5(device) {
   const found = [];
+  if (device.management?.interfaces)
+    found.push("management.interfaces, which only FortiOS builds for now");
   for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
     if (iface.type === "bridge")
       found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);

package/dist/types/schema/system.d.ts

@@ -84,6 +84,8 @@ export type SnmpUser = {
 export type Management<I extends string, C extends string> = {
     /** Sources allowed to every service that does not set its own. */
     allow?: readonly Prefix[];
+    /** The ports and interfaces the services answer on; every other one answers ping alone. Every one with an address when absent. */
+    interfaces?: readonly I[];
     /** Secure shell. */
     ssh?: Service & {
         /** Also offer legacy ciphers, MACs and key exchanges. Off when absent. */

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.33.0",
+    "version": "0.34.0",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",
@@ -40,6 +40,11 @@
             "name": "Rafly Maulana",
             "email": "rafly@tako.id",
             "url": "https://raflymaulana.com"
+        },
+        {
+            "name": "hzmi",
+            "email": "hzmi@tako.id",
+            "url": "https://hzmi.xyz"
         }
     ],
     "type": "module",

package/src/adapters/devices/fortios/render.ts

@@ -495,6 +495,10 @@ function routed(entry: Block, device: Device, name: string, settings: RoutedSett
         return;
     }
 
+    // Services answer only where the config says, when it says; ping everywhere.
+    const answering = device.management?.interfaces;
+    if (answering && !answering.includes(name)) access = "ping";
+
     const addresses = addressesOf(settings);
     const ipv4 = addresses.filter((address) => familyOf(host(address)) === "ipv4");
     const ipv6 = addresses.filter((address) => familyOf(host(address)) === "ipv6");

package/src/adapters/devices/junos/index.ts

@@ -595,6 +595,7 @@ export function unsupported(device: Device): string[] {
     }
 
     if (management.console) found.push("management.console, the console uses the device's users");
+    if (management.interfaces) found.push("management.interfaces, which only FortiOS builds for now");
     if (management.native?.interfaces?.length) found.push("management.native.interfaces, NETCONF runs over IP only");
     if (management.ssh?.auth_timeout || management.ssh?.auth_retries) found.push("management.ssh.auth_timeout and auth_retries");
 

package/src/adapters/devices/raisecom-ros/index.ts

@@ -420,6 +420,8 @@ export async function read(device: Device, _network: readonly Device[] = [], opt
 export function unsupported(device: Device): string[] {
     const found: string[] = [];
 
+    if (device.management?.interfaces) found.push("management.interfaces, which only FortiOS builds for now");
+
     for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
         if (iface.type === "bridge") found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
         if (iface.type === "vlan" && iface.mac) found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);

package/src/adapters/devices/routeros/index.ts

@@ -192,6 +192,7 @@ export function unsupported(device: Device): string[] {
     const management = device.management;
 
     if (management?.console) found.push("management.console, the console uses the device's users");
+    if (management?.interfaces) found.push("management.interfaces, which only FortiOS builds for now");
     if (management?.privilege_password) found.push("management.privilege_password, the platform has no privileged mode");
 
     if (management?.snmp?.port) found.push("management.snmp.port");

package/src/adapters/devices/vrp/index.ts

@@ -639,6 +639,8 @@ function configurationOf(device: Device, dump: string): string {
 export function unsupported(device: Device): string[] {
     const found: string[] = [];
 
+    if (device.management?.interfaces) found.push("management.interfaces, which only FortiOS builds for now");
+
     for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
         if (iface.type === "bridge") found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
         if (iface.type === "vlan" && iface.mac) found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);

package/src/schema/system.ts

@@ -89,6 +89,8 @@ export type SnmpUser = {
 export type Management<I extends string, C extends string> = {
     /** Sources allowed to every service that does not set its own. */
     allow?: readonly Prefix[];
+    /** The ports and interfaces the services answer on; every other one answers ping alone. Every one with an address when absent. */
+    interfaces?: readonly I[];
     /** Secure shell. */
     ssh?: Service & {
         /** Also offer legacy ciphers, MACs and key exchanges. Off when absent. */