@takodotid/circuit 0.34.0 → 0.34.2

package/dist/cli/index.js

@@ -6139,6 +6139,7 @@ var ORDER = [
   "/snmp",
   "/tool",
   "/user",
+  "/system logging action",
   "/system"
 ];
 function rank(menu) {
@@ -7779,7 +7780,8 @@ var DEVICE_FACTS3 = [
   "authorization-scheme default",
   "accounting-scheme default",
   "domain default",
-  "Info:"
+  "Info:",
+  "snmp-agent local-engineid"
 ];
 var UNDO_BY_KEYWORD2 = /^(description|name|port default vlan|port link-type|port trunk pvid vlan|set authentication password|eth-trunk|ip binding vpn-instance|ssh server cipher|ssh server hmac|ssh server key-exchange)\b/;
 function undo2(line) {
@@ -8170,6 +8172,7 @@ function snmp4(config, device) {
     config.line("snmp-agent mib-view included all iso");
     config.line(`snmp-agent group v3 ${SNMP_GROUP3} privacy read-view all${guarded ? ` acl ${MANAGEMENT_ACL2}` : ""}`);
     for (const [name, user] of Object.entries(snmp.users)) {
+      config.line(`snmp-agent usm-user v3 ${name}`);
       config.line(`snmp-agent usm-user v3 ${name} group ${SNMP_GROUP3}`);
       config.line(`snmp-agent usm-user v3 ${name} authentication-mode ${SNMP_AUTH4[user.auth]} cipher ${marker(user.auth_password)}`);
       config.line(`snmp-agent usm-user v3 ${name} privacy-mode ${SNMP_PRIVACY3[user.privacy]} cipher ${marker(user.privacy_password)}`);

package/dist/presets/index.js

@@ -33,10 +33,6 @@ var AMPLIFIERS = {
 };
 var ASKED = new Set([AMPLIFIERS.dns, AMPLIFIERS.ntp, AMPLIFIERS.snmp]);
 function antiAmplification(destinations, options = {}) {
-  const below1024Except = (port) => [
-    { min: 0, max: port - 1 },
-    { min: port + 1, max: 1023 }
-  ];
   return destinations.flatMap((dst) => [
     ...(options.keep_fragments ?? []).filter((prefix) => contains2(dst, prefix)).map((prefix) => ({
       description: `UDP fragments to ${prefix} kept`,
@@ -44,11 +40,18 @@ function antiAmplification(destinations, options = {}) {
       action: "accept"
     })),
     { description: `UDP fragments to ${dst}`, match: { protocol: "udp", dst, src_port: 0 }, action: "drop" },
-    ...Object.entries(AMPLIFIERS).map(([name, port]) => ({
-      description: ASKED.has(port) ? `UDP to ${dst} from ${name}, to a port below 1024` : `UDP to ${dst} from ${name}`,
-      match: { protocol: "udp", dst, src_port: port, ...ASKED.has(port) ? { dst_port: below1024Except(port) } : {} },
-      action: "drop"
-    }))
+    ...Object.entries(AMPLIFIERS).flatMap(([name, port]) => ASKED.has(port) ? [
+      {
+        description: `UDP to ${dst} from ${name}, between two servers`,
+        match: { protocol: "udp", dst, src_port: port, dst_port: port },
+        action: "accept"
+      },
+      {
+        description: `UDP to ${dst} from ${name}, to a port below 1024`,
+        match: { protocol: "udp", dst, src_port: port, dst_port: { min: 0, max: 1023 } },
+        action: "drop"
+      }
+    ] : [{ description: `UDP to ${dst} from ${name}`, match: { protocol: "udp", dst, src_port: port }, action: "drop" }])
   ]);
 }
 var BAD_TCP_FLAGS = [

package/dist/types/presets/index.d.ts

@@ -37,7 +37,7 @@ export type AntiAmplificationOptions = {
  * Hardware ACL rules dropping reflected UDP floods toward `destinations`, in the switch chip, without limiting anything else.
  *
  * - Replies from an amplifier no host asks across the internet are dropped.
- * - Replies from DNS, NTP and SNMP are dropped only toward a port below 1024 that is not the service's own. A host that runs its own resolver, time server or monitoring keeps its answers.
+ * - Replies from DNS, NTP and SNMP are dropped only toward a port below 1024 that is not the service's own. A host that runs its own resolver, time server or monitoring keeps its answers. The service's own port passes first, so every drop takes the one range 0 to 1023: a switch chip has few port-range checkers, and on RouterOS a rule past them is invalid with every rule after it.
  * - The fragments after the first carry no port, and a switch chip reads them as port 0. They are dropped, but toward `keep_fragments`.
  */
 export declare function antiAmplification(destinations: readonly Prefix[], options?: AntiAmplificationOptions): AclRule<never>[];

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.34.0",
+    "version": "0.34.2",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",

package/src/adapters/devices/routeros/TRAPS.md

@@ -44,3 +44,6 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - On the serial console, the prompt can come twice after a login. The console echoes a long command wrapped at 80 columns, and a `print` that fills the screen stops at `-- [Q quit|D dump|down]`, where `D` prints the rest.
 - Every VLAN interface on the bridge has the bridge's MAC, and the bridge keeps a frame to that MAC on whatever VLAN it arrives. A gateway in front of a transparent firewall then never gets its replies: they come back on the inside VLAN and stop at the bridge. A MACVLAN on the VLAN interface gives the gateway a MAC of its own, and its replies cross the firewall back; proved with a FortiGate 3700D in transparent mode, the session offloaded to its NP6.
 - A second VLAN interface with the same VLAN ID on the same interface is refused, `already have such vlan`, so a VLAN interface is known by its interface and VLAN ID, and a new name is a rename.
+- A switch rule the chip cannot hold is flagged `I`, invalid, and every rule after it is invalid too, with no log line. On a CCR2216 (98DX8525, 7.23) it came at the sixth distinct `dst-port` range, with 66 rules in all, far below the 1,024 MikroTik lists: the amplifier drops toward every VLAN after it did nothing. Few distinct ranges, and check `print count-only where invalid` after an apply.
+- A MACVLAN on a VLAN interface is not routed in the switch chip: its connected route never takes the `H` flag, even with `l3-hw-offloading=yes` on the VLAN under it.
+- A `/system logging` rule naming an action that does not exist yet is refused, `input does not match any value of action`, and `:parse` does not catch it. The action is added first; seen on a CCR2216 on 7.23.5, where the refusal restored the backup.

package/src/adapters/devices/routeros/plan.ts

@@ -48,6 +48,8 @@ const ORDER = [
     "/snmp",
     "/tool",
     "/user",
+    // A logging rule names its action, so the action exists first.
+    "/system logging action",
     "/system",
 ];
 

package/src/adapters/devices/vrp/TRAPS.md

@@ -23,3 +23,4 @@ Behaviour that looks like something else. Each one has been hit on a CE6855 runn
 - A VLAN name is unique across VLANs: a new VLAN cannot take a name another still has. VLANs no longer used, and their VLAN interfaces, are removed first, in the same candidate.
 - `undo ssh server key-exchange <algorithms>` is refused with "Too many parameters"; `undo ssh server key-exchange` takes none. `hmac` was proved the same way. `cipher` is undone the same way but was not proved on its own.
 - A console on a password only (`passwordOnly`) shows `Please Press ENTER.` after a logout or a refused password, and `Error: The password is invalid.` for a wrong one.
+- Once SNMP is on, the switch prints an engine ID of its own, `snmp-agent local-engineid`, derived from its MAC, and prints each SNMPv3 user as a bare `snmp-agent usm-user v3 <name>` line before its settings. Planning against either as unrendered would undo the user; seen on a CE6855 on V200R005C00SPC800.

package/src/adapters/devices/vrp/index.ts

@@ -33,6 +33,8 @@ const DEVICE_FACTS = [
     "accounting-scheme default",
     "domain default",
     "Info:",
+    // Derived from the switch's MAC once SNMP is on.
+    "snmp-agent local-engineid",
 ];
 
 /** Lines whose removal takes only their keyword, not their value. */
@@ -493,6 +495,8 @@ function snmp(config: Config, device: Device): void {
         config.line(`snmp-agent group v3 ${SNMP_GROUP} privacy read-view all${guarded ? ` acl ${MANAGEMENT_ACL}` : ""}`);
 
         for (const [name, user] of Object.entries(snmp.users)) {
+            // The switch prints a user's own line before its settings.
+            config.line(`snmp-agent usm-user v3 ${name}`);
             config.line(`snmp-agent usm-user v3 ${name} group ${SNMP_GROUP}`);
             config.line(`snmp-agent usm-user v3 ${name} authentication-mode ${SNMP_AUTH[user.auth]} cipher ${marker(user.auth_password)}`);
             config.line(

package/src/presets/index.ts

@@ -54,15 +54,10 @@ export type AntiAmplificationOptions = {
  * Hardware ACL rules dropping reflected UDP floods toward `destinations`, in the switch chip, without limiting anything else.
  *
  * - Replies from an amplifier no host asks across the internet are dropped.
- * - Replies from DNS, NTP and SNMP are dropped only toward a port below 1024 that is not the service's own. A host that runs its own resolver, time server or monitoring keeps its answers.
+ * - Replies from DNS, NTP and SNMP are dropped only toward a port below 1024 that is not the service's own. A host that runs its own resolver, time server or monitoring keeps its answers. The service's own port passes first, so every drop takes the one range 0 to 1023: a switch chip has few port-range checkers, and on RouterOS a rule past them is invalid with every rule after it.
  * - The fragments after the first carry no port, and a switch chip reads them as port 0. They are dropped, but toward `keep_fragments`.
  */
 export function antiAmplification(destinations: readonly Prefix[], options: AntiAmplificationOptions = {}): AclRule<never>[] {
-    const below1024Except = (port: number) => [
-        { min: 0, max: port - 1 },
-        { min: port + 1, max: 1023 },
-    ];
-
     return destinations.flatMap((dst) => [
         ...(options.keep_fragments ?? [])
             .filter((prefix) => contains(dst, prefix))
@@ -72,11 +67,22 @@ export function antiAmplification(destinations: readonly Prefix[], options: Anti
                 action: "accept",
             })),
         { description: `UDP fragments to ${dst}`, match: { protocol: "udp", dst, src_port: 0 }, action: "drop" },
-        ...Object.entries(AMPLIFIERS).map(([name, port]): AclRule<never> => ({
-            description: ASKED.has(port) ? `UDP to ${dst} from ${name}, to a port below 1024` : `UDP to ${dst} from ${name}`,
-            match: { protocol: "udp", dst, src_port: port, ...(ASKED.has(port) ? { dst_port: below1024Except(port) } : {}) },
-            action: "drop",
-        })),
+        ...Object.entries(AMPLIFIERS).flatMap(([name, port]): AclRule<never>[] =>
+            ASKED.has(port)
+                ? [
+                      {
+                          description: `UDP to ${dst} from ${name}, between two servers`,
+                          match: { protocol: "udp", dst, src_port: port, dst_port: port },
+                          action: "accept",
+                      },
+                      {
+                          description: `UDP to ${dst} from ${name}, to a port below 1024`,
+                          match: { protocol: "udp", dst, src_port: port, dst_port: { min: 0, max: 1023 } },
+                          action: "drop",
+                      },
+                  ]
+                : [{ description: `UDP to ${dst} from ${name}`, match: { protocol: "udp", dst, src_port: port }, action: "drop" }]
+        ),
     ]);
 }