@takodotid/circuit 0.34.3 → 0.35.0

package/src/adapters/devices/fortios/index.ts

@@ -1,923 +0,0 @@
-// Fortinet FortiOS 6.2, as on the FortiGate 3700D.
-//
-// The configuration is read and written as `config` blocks, the form `show` prints. A change applies as it is sent. Before a plan is sent the device is set to revert: a change not saved within the rollback time is undone by reloading the saved configuration, and Circuit reloads it at once when a line is refused. A fresh login proves access before the change is saved. Configuration transactions are not used: on 6.2 one keeps references its own deletions dropped, and one whose session is cut off keeps what it touched locked.
-
-import type { Client } from "ssh2";
-import { familyOf, host, split } from "../../../core/addr";
-import { MARKER, resolve, valueOfReference } from "../../../core/secrets";
-import type { AclRule, Device, Family, FilterRule } from "../../../schema";
-import { type ConsoleDialect, consoleLogin, consoleOf, openConsole } from "../../../transport/console";
-import { connect, managementHost, shell } from "../../../transport/ssh";
-import { portsOf, spell } from "../catalog";
-import type { ApplyOptions, DeviceAdapter, Plan, ReadOptions } from "../types";
-import { acceptsBeforeDrop, familiesOf, isImplied, serviceOf } from "./firewall";
-import { holderOf, interfaceFor, isTransparent, network, settingsOf, subnet, transparentManagement } from "./names";
-import { clean, plan } from "./plan";
-import { COLLECTORS, FULL, HELPERS, RESOLVERS, render, SECTIONS, SPEEDS, SSH_KEYS, vlanParent, VRFS, zoneOf } from "./render";
-import { BITS, PREFIX_LIST, routingGaps } from "./routing";
-import { Block, linesOf, parse, print, quote } from "./tree";
-
-/** The release this adapter renders for, and was proved on. */
-const SUPPORTED = "6.2";
-
-/** The longest name the platform takes for an interface, and for an address or service. */
-const NAME_LENGTH = { interface: 15, object: 79 } as const;
-
-/** Names the platform keeps for interfaces of its own. */
-const RESERVED_INTERFACES = new Set(["any", "modem", "ssl.root"]);
-
-/** What a session reads and writes: an SSH shell, or anything else that streams the CLI. */
-export type Channel = {
-    write(data: string): unknown;
-    on(event: "data", listener: (chunk: Buffer) => void): unknown;
-    on(event: "close", listener: () => void): unknown;
-    removeListener(event: "data", listener: (chunk: Buffer) => void): unknown;
-    removeListener(event: "close", listener: () => void): unknown;
-};
-
-/** The prompt at the end of what the device printed, `host # ` or `host (context) # `, or a question it waits on. */
-const PROMPT = /(?:^|\n)[^\n]*[#$] $/;
-const QUESTION = /\(y\/n\)\s*$/;
-
-/** The pre-login banner, which waits for the reader to accept it. */
-const BANNER = /\(Press 'a' to accept\):\s*$/;
-
-/** The device ended the session and asks for a login again. */
-const LOGGED_OUT = /(?:^|\n)[^\n]*login: $/;
-
-/** The pager the device stops at, and how it erases itself once answered. */
-const PAGER = /--More-- \r? *\r/g;
-
-/** What the device prints when it refuses a line. */
-const REFUSED =
-    /Command fail\. Return code|Unknown action|parse error|discard the setting|MUST be set|Can not config|isn't supported|(?:^|\n)Invalid /;
-
-/** A CLI over a channel: one line at a time, and what the device printed until its prompt came back. */
-export class Cli {
-    /** The prompt that ended the last answer, which shows where the session is: `(port1)` inside an entry. */
-    prompt = "";
-
-    constructor(
-        private readonly channel: Channel,
-        private readonly newline = "\n"
-    ) {}
-
-    /** Wait for the prompt, after logging in. */
-    async ready(timeout = 30_000): Promise<void> {
-        await this.collect(timeout);
-    }
-
-    /** Send one line and return what the device printed after it, without the echo or the prompt. */
-    async run(line: string, timeout = 60_000): Promise<string> {
-        this.channel.write(line + this.newline);
-        const output = await this.collect(timeout);
-
-        const lines = output.split("\n");
-        return lines.slice(1, -1).join("\n");
-    }
-
-    /** Answer a question the device asked. */
-    answer(reply: "y" | "n", timeout = 60_000): Promise<string> {
-        this.channel.write(reply);
-        return this.collect(timeout);
-    }
-
-    /** What the device prints until its prompt or a question. A session the device ended, or that went silent, fails. */
-    private collect(timeout: number): Promise<string> {
-        return new Promise((done, fail) => {
-            let raw = "";
-            let settle: ReturnType<typeof setTimeout> | undefined;
-
-            const text = () => raw.replace(PAGER, "").replace(/\r/g, "");
-
-            const stop = () => {
-                clearTimeout(limit);
-                clearTimeout(settle);
-                this.channel.removeListener("data", onData);
-                this.channel.removeListener("close", onClose);
-            };
-
-            const finish = () => {
-                stop();
-
-                const output = text();
-                this.prompt = output.split("\n").at(-1) ?? "";
-                done(output);
-            };
-
-            const onData = (chunk: Buffer) => {
-                raw += chunk.toString("utf8");
-                if (raw.endsWith("--More-- ")) this.channel.write(" ");
-                if (BANNER.test(raw)) this.channel.write("a");
-
-                clearTimeout(settle);
-
-                if (LOGGED_OUT.test(text())) {
-                    stop();
-                    fail(new Error("the device ended the session"));
-                } else if (PROMPT.test(text()) || QUESTION.test(text())) {
-                    settle = setTimeout(finish, 300);
-                }
-            };
-
-            const onClose = () => {
-                stop();
-                fail(new Error("the device ended the session"));
-            };
-
-            const limit = setTimeout(() => {
-                stop();
-                fail(new Error(`no prompt within ${timeout / 1000} seconds: ${text().slice(-200)}`));
-            }, timeout);
-
-            this.channel.on("data", onData);
-            this.channel.on("close", onClose);
-        });
-    }
-}
-
-export async function login(device: Device): Promise<Client> {
-    const user = device.users?.[device.connection.user];
-    if (!user) throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
-
-    return connect({
-        host: managementHost(device),
-        port: device.connection.port,
-        user: device.connection.user,
-        password: resolve(user.password),
-    });
-}
-
-/** How the FortiOS console asks for a login, and what moves it on from where the last session left it. */
-export const FORTIOS_CONSOLE: ConsoleDialect = {
-    login: /login: $/,
-    password: /Password: $/,
-    prompt: /[#$] $/,
-    logout: "exit",
-    others: [
-        [BANNER, "a"],
-        [/--More-- $/, "q"],
-        [/\([^)\n]*\) [#$] $/, "end\n"],
-    ],
-};
-
-/** Log out of a console, so no session is left open on it. */
-async function consoleLogout(cli: Cli): Promise<void> {
-    await leave(cli).catch(() => undefined);
-    await cli.run("exit", 10_000).catch(() => undefined);
-}
-
-/** Log in on the console, open the CLI, and run `work` in it. `work` is also given a way to log in afresh on the same console. */
-async function consoleSession<T>(device: Device, work: (cli: Cli, relogin: () => Promise<void>) => Promise<T>): Promise<T> {
-    const { console, user, password } = consoleOf(device);
-    const opened = await openConsole(console);
-
-    try {
-        await consoleLogin(opened.channel, FORTIOS_CONSOLE, user, password, console.passwordOnly);
-        const cli = new Cli(opened.channel);
-        const relogin = () => consoleLogin(opened.channel, FORTIOS_CONSOLE, user, password, console.passwordOnly);
-
-        const result = await work(cli, relogin);
-        await consoleLogout(cli);
-        return result;
-    } finally {
-        opened.close();
-    }
-}
-
-/** Log in, open the CLI, and run `work` in it: through the console when asked, else over SSH. */
-async function session<T>(device: Device, work: (cli: Cli) => Promise<T>, options: ReadOptions = {}): Promise<T> {
-    if (options.console) return consoleSession(device, (cli) => work(cli));
-
-    const client = await login(device);
-
-    try {
-        const channel = await shell(client, 4000);
-        const cli = new Cli(channel);
-        await cli.ready();
-
-        const result = await work(cli);
-        channel.end();
-        return result;
-    } finally {
-        client.end();
-    }
-}
-
-/** Refuse a device on a release this adapter was not proved on, before anything is read or sent. */
-export async function checkVersion(cli: Cli, device: Device): Promise<void> {
-    const status = await cli.run("get system status");
-    const version = /^Version: \S+ v(\d+)\.(\d+)\.(\d+)/m.exec(status);
-
-    if (!version) throw new Error(`${device.name} did not say which FortiOS it runs: ${status.slice(0, 200)}`);
-    if (`${version[1]}.${version[2]}` !== SUPPORTED) {
-        throw new Error(
-            `${device.name} runs FortiOS ${version[1]}.${version[2]}.${version[3]}; this adapter renders for FortiOS ${SUPPORTED}`
-        );
-    }
-}
-
-/** Secrets the device prints: a password or an SNMPv3 key as a cipher, a certificate's key encrypted, and the SNMP community in clear. None leave the read. */
-export function scrub(text: string): string {
-    const root = parse(text);
-
-    for (const { block } of root.blocks.get("system snmp community")?.entries.values() ?? []) {
-        if (block.settings.has("name")) block.settings.set("name", '"<redacted>"');
-    }
-
-    const hide = (block: ReturnType<typeof parse>) => {
-        for (const [key, value] of block.settings) {
-            if (value.startsWith("ENC ")) block.settings.set(key, "ENC <redacted>");
-            if (key === "private-key") block.settings.set(key, '"<redacted>"');
-        }
-
-        for (const child of block.blocks.values()) hide(child);
-        for (const entry of block.entries.values()) hide(entry.block);
-    };
-    hide(root);
-
-    return print(root);
-}
-
-/** Every section Circuit manages, as the device holds it, credentials scrubbed. */
-export async function readConfig(cli: Cli, device: Device): Promise<string> {
-    await checkVersion(cli, device);
-
-    const parts: string[] = [];
-
-    for (const section of SECTIONS) {
-        const show = FULL.includes(section) ? "show full-configuration" : "show";
-        parts.push(await cli.run(`${show} ${section}`, 120_000));
-    }
-
-    const text = parts.join("\n");
-    if (!/^config system global$/m.test(text)) throw new Error(`${device.name} returned no configuration`);
-
-    return scrub(clean(text));
-}
-
-export function read(device: Device, _network: readonly Device[] = [], options: ReadOptions = {}): Promise<string> {
-    return session(device, (cli) => readConfig(cli, device), options);
-}
-
-/**
- * A line with each secret's value in place, escaped inside its quotes. A certificate's key from a variable is PEM encoded as one line of base64, and is sent as the PEM it holds. A file saved with Windows line endings is sent with plain ones: the CLI takes each carriage return as a line of its own, and refuses the key, `Invalid private key`. A `?`, which the CLI takes as a call for help, is typed literally.
- */
-export function withSecrets(line: string): string {
-    const key = line.startsWith("set private-key ");
-
-    const filled = line.replace(MARKER, (_, reference: string) => {
-        const value = valueOfReference(reference);
-        const text = key && !value.includes("-----BEGIN") ? Buffer.from(value, "base64").toString("utf8").trim() : value;
-        return text.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
-    });
-
-    return filled.replace(/\r\n?/g, "\n").replace(/\?/g, "\u0016?");
-}
-
-/** Leave every `config` and `edit` level, back to the top prompt. */
-async function leave(cli: Cli): Promise<void> {
-    for (let level = 0; level < 10 && /\(.*\) [#$] $/.test(cli.prompt); level++) await cli.run("end");
-}
-
-/** How a change that could cut access is guarded: the device reloads its saved configuration after `seconds` unless `prove` shows access survived. */
-export type Guard = { seconds: number; prove: () => Promise<void> };
-
-/** Send the lines that set how the device saves changes. */
-async function saving(cli: Cli, mode: "revert" | "automatic", seconds?: number): Promise<void> {
-    const lines = ["config system global", `set cfg-save ${mode}`, ...(seconds ? [`set cfg-revert-timeout ${seconds}`] : []), "end"];
-
-    for (const line of lines) {
-        const answer = await cli.run(line);
-        if (REFUSED.test(answer)) throw new Error(`the device refused ${line}: ${answer.trim().slice(0, 300)}`);
-    }
-}
-
-/**
- * Send a plan line by line, each applied as it arrives. The device is first set to revert what is not saved, so a refused line or a fresh login that fails reloads its saved configuration. Once access is proved the change is saved, and changes save themselves again.
- */
-export async function configure(cli: Cli, plan: Plan, guard: Guard): Promise<void> {
-    const minutes = guard.seconds / 60;
-    await saving(cli, "revert", guard.seconds);
-
-    // The session still open reloads the saved configuration at once; if it cannot, the device does when the time runs out.
-    const restore = async (reason: string) => {
-        await leave(cli).catch(() => undefined);
-        await cli.run("execute cfg reload").catch(() => undefined);
-        return new Reloaded(
-            `${reason}\n    the device reloads its saved configuration, which undoes what was sent, at the latest in ${minutes} minutes`
-        );
-    };
-
-    for (const step of plan.steps) {
-        for (const line of step.send) {
-            const answer = await cli.run(withSecrets(line)).catch((error: Error) => error);
-            if (answer instanceof Error) throw await restore(`${step.title}: ${line}\n    ${answer.message}`);
-            if (/System will reload/.test(answer)) {
-                throw new Reloaded(
-                    `${step.title}: ${line}\n    the rollback time ran out while the plan was sent, and the device is reloading its saved configuration`
-                );
-            }
-
-            if (REFUSED.test(answer)) throw await restore(`${step.title}: ${line}\n    device said: ${answer.trim().slice(0, 300)}`);
-
-            // No line of a plan should ask; one that does is answered no and treated as refused.
-            if (QUESTION.test(cli.prompt)) {
-                await cli.answer("n").catch(() => undefined);
-                throw await restore(`${step.title}: ${line}\n    device asked: ${cli.prompt.trim()}`);
-            }
-        }
-    }
-
-    console.log(`  sent; the device reloads its saved configuration in ${minutes} minutes unless access is proved`);
-
-    try {
-        await guard.prove();
-    } catch (error) {
-        throw await restore(`a fresh login failed: ${(error as Error).message}`);
-    }
-
-    const saved = await cli.run("execute cfg save", 120_000);
-    if (!/config saved|no config to be saved/.test(saved)) {
-        throw new Error(
-            `access was proved but the save failed; the device reverts in ${minutes} minutes:\n    ${saved.trim().slice(0, 300)}`
-        );
-    }
-
-    await saving(cli, "automatic");
-    console.log("  logged in again, saved");
-}
-
-/** A failure after which the device reloads its saved configuration, which still says to revert. */
-class Reloaded extends Error {}
-
-/** How long a device may take to come back from a reload of its configuration, and how often to try it. */
-const RELOAD = { attempts: 20, interval: 15_000 } as const;
-
-/**
- * Once the device is back from a reload, set it to save changes on its own again: the saved configuration still says to revert. Setting it saves what runs, so it is set only once the device says nothing is left to reload; until then the reload is asked for again.
- */
-async function settle(device: Device, options: ReadOptions): Promise<string> {
-    for (let attempt = 0; attempt < RELOAD.attempts; attempt++) {
-        await new Promise((done) => setTimeout(done, RELOAD.interval));
-
-        const settled = await session(
-            device,
-            async (cli) => {
-                if (!/no config to be reloaded/.test(await cli.run("execute cfg reload"))) return false;
-                await saving(cli, "automatic");
-                return true;
-            },
-            options
-        ).catch(() => false);
-        if (settled) return "the device is back and saves changes on its own again";
-    }
-
-    return "the device did not come back in time and still reverts every change; set `cfg-save automatic` under `config system global`";
-}
-
-export async function apply(device: Device, network: readonly Device[], changes: Plan, options: ApplyOptions): Promise<void> {
-    await applyOnce(device, changes, options);
-
-    // Switching the operation mode makes changes of its own, such as a static route in each family and memory logging on, which a plan made before it could not see. One more pass, planned against what the device now runs, takes them back.
-    const switched = changes.steps.some((step) => step.send.some((line) => line.startsWith("set opmode ")));
-    if (!switched) return;
-
-    const again = plan(render(device), await read(device, network, options), options);
-    if (!again.steps.length) return;
-
-    console.log("  the operation mode changed; applying what it added on its own");
-    await applyOnce(device, again, options);
-}
-
-async function applyOnce(device: Device, plan: Plan, options: ApplyOptions): Promise<void> {
-    const seconds = options.rollback * 60;
-
-    try {
-        // Through the console, a fresh login on the same console proves the change left the device's logins working; over SSH, a fresh SSH session proves the management path too.
-        if (options.console) {
-            await consoleSession(device, async (cli, relogin) => {
-                await checkVersion(cli, device);
-                await configure(cli, plan, { seconds, prove: relogin });
-            });
-            return;
-        }
-
-        await session(device, async (cli) => {
-            await checkVersion(cli, device);
-
-            await configure(cli, plan, {
-                seconds,
-                prove: async () => {
-                    const proof = await login(device);
-                    proof.end();
-                },
-            });
-        });
-    } catch (error) {
-        if (!(error instanceof Reloaded)) throw error;
-        throw new Error(`${error.message}\n    ${await settle(device, options)}`);
-    }
-}
-
-/** The lines that replace a prefix list's entries with what a registry returned: every entry is purged, then each prefix added, matching it and anything more specific. */
-export function fillLines(set: string, family: Family, prefixes: string[]): string[] {
-    const list = new Block();
-    prefixes.forEach((prefix, index) => {
-        const rule = list.entry(index + 1);
-        rule.set(family === "ipv4" ? "prefix" : "prefix6", family === "ipv4" ? subnet(network(prefix)) : network(prefix));
-        if (split(network(prefix)).len < BITS[family]) rule.set("le", BITS[family]);
-    });
-
-    return [
-        `config ${PREFIX_LIST[family]}`,
-        `edit ${quote(set)}`,
-        "config rule",
-        "purge",
-        ...linesOf(list).map((line) => line.trim()),
-        "end",
-        "next",
-        "end",
-    ];
-}
-
-/** Replace a prefix list `refresh` fetched. It cannot cut access, so it is sent without a guard, and saved as it goes. `purge` asks to confirm, and is answered yes. */
-export async function fill(device: Device, _network: readonly Device[], set: string, family: Family, prefixes: string[]): Promise<void> {
-    await session(device, async (cli) => {
-        await checkVersion(cli, device);
-
-        for (const line of fillLines(set, family, prefixes)) {
-            let answer = await cli.run(line);
-            if (QUESTION.test(cli.prompt) && line === "purge") answer = await cli.answer("y");
-            if (REFUSED.test(answer)) throw new Error(`${set}: ${line}\n    device said: ${answer.trim().slice(0, 300)}`);
-        }
-
-        console.log(`  ${set}: ${prefixes.length} prefixes on the device`);
-    });
-}
-
-export function unsupported(device: Device): string[] {
-    const found: string[] = [];
-
-    found.push(...systemGaps(device));
-    found.push(...managementGaps(device));
-    found.push(...interfaceGaps(device));
-    found.push(...staticGaps(device));
-    found.push(...routingGaps(device));
-    found.push(...firewallGaps(device));
-    found.push(...serviceGaps(device));
-
-    if (device.stp) found.push("stp, ports are routed");
-    found.push(...transparentGaps(device));
-
-    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-        if (iface.type === "vlan" && iface.mac) found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
-    }
-    if (Object.keys(device.vrfs ?? {}).length > VRFS) found.push(`vrfs, at most ${VRFS}`);
-
-    for (const [name, vrf] of Object.entries(device.vrfs ?? {})) {
-        if (vrf.description) found.push(`vrfs.${name}.description, the platform numbers a VRF and keeps no description`);
-    }
-
-    return found;
-}
-
-/**
- * What transparent mode, which a bridge needs, leaves out: every address but one IPv4 management address outside the bridges, routing beyond static routes for it, NAT and DHCP. Without a management address the device is reached through its console and answers no service.
- */
-function transparentGaps(device: Device): string[] {
-    if (!isTransparent(device)) return [];
-
-    const found: string[] = [];
-    const where = "in transparent mode, which a bridge needs";
-    const management = transparentManagement(device);
-
-    if (device.connection.host && device.connection.host !== (management && host(management.address)))
-        found.push(`connection.host, ${where}: only the management address, one IPv4 address outside the bridges`);
-
-    const holders = [
-        ...Object.entries(device.ports ?? {}).map(([name, port]) => [`ports.${name}`, name, port?.addresses] as const),
-        ...Object.entries(device.interfaces ?? {}).map(([name, iface]) => [`interfaces.${name}`, name, iface.addresses] as const),
-    ];
-
-    for (const [path, name, addresses] of holders) {
-        const extra = (addresses ?? []).filter(
-            (entry) => !(typeof entry === "string" && management && name === management.name && entry === management.address)
-        );
-        if (extra.length) found.push(`${path}.addresses, ${where}: one IPv4 address in all, outside the bridges, for management`);
-    }
-
-    const routing = device.routing;
-    if (routing?.bgp || routing?.ospf) found.push(`routing, ${where}: static routes only`);
-
-    for (const [index, route] of (routing?.static ?? []).entries()) {
-        const at = `routing.static[${index}]`;
-        if (!management) found.push(`${at}, ${where}: a route needs the management address`);
-        if (!route.via || familyOf(route.via) !== "ipv4" || route.interface || route.blackhole || route.vrf)
-            found.push(`${at}, ${where}: only an IPv4 next hop, for the management address`);
-    }
-
-    if (device.firewall?.nat) found.push(`firewall.nat, ${where}`);
-    if (device.dhcp && Object.keys(device.dhcp).length) found.push(`dhcp, ${where}`);
-
-    if (!management) {
-        const services = device.management ?? {};
-        for (const service of ["ssh", "telnet", "http", "https", "api", "api_tls", "snmp", "native"] as const) {
-            if (services[service]) found.push(`management.${service}, ${where}: the device has no management address to answer on`);
-        }
-    }
-
-    return found;
-}
-
-function systemGaps(device: Device): string[] {
-    const found: string[] = [];
-    const system = device.system ?? {};
-
-    if (system.timezone && !zoneOf(system.timezone)) found.push(`system.timezone ${system.timezone}, the platform has no zone for it`);
-    if (system.release_channel) found.push("system.release_channel, the platform's firmware has no release channel to follow");
-    if (system.transceiver_monitoring !== undefined)
-        found.push("system.transceiver_monitoring, the platform reads optics without being told");
-    if (system.ip?.syn_cookies) found.push("system.ip.syn_cookies, the platform has a SYN proxy per DoS policy, not SYN cookies");
-
-    const local = system.logging?.local;
-    if (local?.files !== undefined || local?.lines_per_file !== undefined) {
-        found.push("system.logging.local.files and lines_per_file, logs kept in memory do not rotate into files");
-    }
-
-    if ((system.logging?.remote?.length ?? 0) > COLLECTORS) found.push(`system.logging.remote, at most ${COLLECTORS} collectors`);
-
-    const servers = system.dns?.servers ?? [];
-    for (const family of ["ipv4", "ipv6"] as const) {
-        if (servers.filter((server) => familyOf(server) === family).length > RESOLVERS.device) {
-            found.push(`system.dns.servers, at most ${RESOLVERS.device} of each family`);
-        }
-    }
-
-    return found;
-}
-
-function managementGaps(device: Device): string[] {
-    const found: string[] = [];
-    const management = device.management ?? {};
-
-    if (management.api || management.api_tls) found.push("management.api and api_tls, the API is served by management.https");
-    if (management.ftp) found.push("management.ftp, the platform has no FTP service");
-    if (management.console) found.push("management.console, the console logs in with the device's users");
-    if (management.privilege_password) found.push("management.privilege_password, the platform has no privileged mode");
-    if (management.native?.interfaces?.length) found.push("management.native.interfaces, FortiManager access runs over IP only");
-    if (management.native?.port) found.push("management.native.port, FortiManager access listens on 541");
-    if (management.ssh?.auth_retries)
-        found.push("management.ssh.auth_retries, the platform counts failed logins per source, not per connection");
-
-    for (const [name, user] of Object.entries(management.snmp?.users ?? {})) {
-        if (user.auth === "sha256") found.push(`management.snmp.users.${name}.auth sha256, the platform authenticates with SHA1 or MD5`);
-    }
-
-    for (const [name, user] of Object.entries(device.users ?? {})) {
-        if ((user.ssh_keys?.length ?? 0) > SSH_KEYS) found.push(`users.${name}.ssh_keys, at most ${SSH_KEYS}`);
-    }
-
-    return found;
-}
-
-/** Every name the platform knows a port by. */
-function portNames(device: Device): Set<string> {
-    return new Set(portsOf(device.platform, device.model).map((port) => spell(device.platform, device.model, port)));
-}
-
-function interfaceGaps(device: Device): string[] {
-    const found: string[] = [];
-    const vlanInterfaces = new Set(
-        Object.values(device.interfaces ?? {}).flatMap((iface) => (iface.type === "vlan" ? [iface.vlan as string] : []))
-    );
-
-    for (const [name, vlan] of Object.entries(device.vlans ?? {})) {
-        if (vlan.description) found.push(`vlans.${name}.description, a VLAN interface holds its own`);
-    }
-
-    for (const [name, port] of Object.entries(device.ports ?? {})) {
-        if (!port) continue;
-
-        const where = `ports.${name}`;
-        const speedClass = name.split("-")[0]!;
-        if (port.speed && !SPEEDS[speedClass]?.[port.speed]) found.push(`${where}.speed ${port.speed}, not in a ${speedClass} cage`);
-
-        for (const field of ["access_vlan", "native_vlan", "stp", "storm_control"] as const) {
-            if (port[field] !== undefined) found.push(`${where}.${field}, ports are routed`);
-        }
-
-        if (port.hardware_offload !== undefined)
-            found.push(`${where}.hardware_offload, offload is decided per policy, which can match many interfaces`);
-
-        if (port.lag) {
-            for (const field of ["addresses", "mtu", "vrrp", "vrf", "lldp", "trunk_vlans", "ipv6_ra", "acl"] as const) {
-                if (port[field] !== undefined) found.push(`${where}.${field}, a LAG member takes its settings from the LAG`);
-            }
-        }
-
-        const acl = port.acl ? device.acls?.[port.acl] : undefined;
-        if (acl) found.push(...aclGaps(`acls.${port.acl}`, acl));
-
-        found.push(...trunkGaps(where, name, port.trunk_vlans, vlanInterfaces, device));
-        found.push(...routedGaps(where, port, false));
-    }
-
-    const ports = portNames(device);
-
-    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-        const where = `interfaces.${name}`;
-
-        if (iface.type === "wireguard") {
-            found.push(`${where}, a wireguard: the platform has no WireGuard`);
-            continue;
-        }
-
-        if (name.length > NAME_LENGTH.interface) found.push(`${where}, a name longer than ${NAME_LENGTH.interface} characters`);
-        if (ports.has(name) || RESERVED_INTERFACES.has(name)) found.push(`${where}, a name the platform gives a port of its own`);
-        if (iface.hardware_offload !== undefined)
-            found.push(`${where}.hardware_offload, offload is decided per policy, which can match many interfaces`);
-
-        if (iface.type === "lag") {
-            if (iface.id !== undefined) found.push(`${where}.id, the platform names a LAG by its key`);
-            for (const field of ["access_vlan", "native_vlan", "stp", "storm_control"] as const) {
-                if (iface[field] !== undefined) found.push(`${where}.${field}, LAGs are routed`);
-            }
-
-            found.push(...trunkGaps(where, name, iface.trunk_vlans, vlanInterfaces, device));
-        }
-
-        if (iface.type === "vlan" && !vlanParent(device, iface.vlan)) {
-            found.push(`${where}, VLAN ${iface.vlan} must be carried tagged by exactly one port or LAG`);
-        }
-
-        if (iface.type === "loopback") {
-            if (iface.mtu !== undefined) found.push(`${where}.mtu, a loopback has no MTU of its own`);
-            if (iface.vrrp?.length) found.push(`${where}.vrrp, a loopback runs no VRRP`);
-        }
-
-        if (iface.type === "gre" || iface.type === "vxlan") {
-            if (!holderOf(device, iface.local)) found.push(`${where}.local, no interface holds ${iface.local}`);
-            if (familyOf(iface.local) !== familyOf(iface.remote)) found.push(`${where}, endpoints of two families`);
-            if (iface.vrrp?.length) found.push(`${where}.vrrp, on a tunnel`);
-            if (iface.ipv6_ra) found.push(`${where}.ipv6_ra, on a tunnel`);
-        }
-
-        if (iface.type === "gre") {
-            for (const entry of iface.addresses ?? []) {
-                if (typeof entry !== "string" && familyOf(host(entry.address)) === "ipv6")
-                    found.push(`${where}.addresses, a peer on an IPv6 address`);
-            }
-
-            const ipv4 = (iface.addresses ?? []).filter(
-                (entry) => familyOf(host(typeof entry === "string" ? entry : entry.address)) === "ipv4"
-            );
-            if (ipv4.some((entry) => typeof entry === "string"))
-                found.push(`${where}.addresses, an IPv4 address on a tunnel takes its peer`);
-            if (ipv4.length > 1) found.push(`${where}.addresses, one IPv4 address`);
-        }
-
-        found.push(...routedGaps(where, iface, iface.type === "gre"));
-    }
-
-    if (device.lldp && typeof device.lldp === "object") {
-        for (const name of device.lldp.interfaces) {
-            const settings = device.interfaces?.[name];
-            if (settings && settings.type !== "lag" && settings.type !== "vlan") found.push(`lldp.interfaces ${name}, a ${settings.type}`);
-        }
-    }
-
-    return found;
-}
-
-/** A port or LAG carries tagged only VLANs that have an interface here, and is the only one carrying each. */
-function trunkGaps(
-    where: string,
-    name: string,
-    vlans: readonly string[] | undefined,
-    withInterface: Set<string>,
-    device: Device
-): string[] {
-    const found: string[] = [];
-
-    for (const vlan of vlans ?? []) {
-        if (!withInterface.has(vlan)) {
-            found.push(`${where}.trunk_vlans ${vlan}, a VLAN with no interface here: the platform routes and does not switch`);
-        } else if (vlanParent(device, vlan) !== name) {
-            found.push(`${where}.trunk_vlans ${vlan}, which another port or LAG also carries`);
-        }
-    }
-
-    return found;
-}
-
-/** Layer 3 settings the platform cannot express on a port or an interface. Only a tunnel takes an address with a peer. */
-function routedGaps(
-    where: string,
-    settings: { addresses?: readonly (string | { address: string; peer: string })[]; vrrp?: readonly { id: number; address: string }[] },
-    tunnel: boolean
-): string[] {
-    const found: string[] = [];
-
-    if (!tunnel && settings.addresses?.some((entry) => typeof entry !== "string"))
-        found.push(`${where}.addresses with a peer, which only a tunnel takes`);
-
-    for (const group of settings.vrrp ?? []) {
-        if (familyOf(group.address) === "ipv6") found.push(`${where}.vrrp ${group.id}, IPv6: the platform runs VRRP for IPv4`);
-    }
-
-    return found;
-}
-
-/** An ACL as the platform's, which only drop: every drop comes before any accept, and no rule limits a rate or matches a VLAN. */
-function aclGaps(where: string, rules: readonly AclRule<string>[]): string[] {
-    const found: string[] = [];
-
-    if (acceptsBeforeDrop(rules)) found.push(`${where}, an accept before a drop: the platform's ACLs only drop`);
-
-    rules.forEach((rule, index) => {
-        if (rule.rate) found.push(`${where}[${index}].rate`);
-        if (rule.match?.vlan) found.push(`${where}[${index}].match.vlan, a port's ACL sees no VLAN`);
-    });
-
-    return found;
-}
-
-function staticGaps(device: Device): string[] {
-    const found: string[] = [];
-    const seen = new Set<string>();
-
-    for (const route of device.routing?.static ?? []) {
-        const where = `routing.static ${route.prefix}`;
-
-        if (route.vrf && route.blackhole)
-            found.push(`${where}, a blackhole in a VRF: a route takes the VRF of the interface it leaves through`);
-        if (route.vrf && route.interface && settingsOf(device, route.interface)?.vrf !== route.vrf) {
-            found.push(`${where}.interface, which is not in VRF ${route.vrf}`);
-        }
-
-        if (route.via && !route.interface && !route.blackhole && !interfaceFor(device, route.via, route.vrf)) {
-            found.push(`${where} via ${route.via}, no interface's own network in its table holds the next hop`);
-        }
-
-        // The device refuses a second route identical to one it has: `Duplicated entry`.
-        const key = [
-            split(route.prefix).addr,
-            split(route.prefix).len,
-            route.via,
-            route.interface,
-            route.blackhole,
-            route.distance,
-            route.vrf,
-        ].join(" ");
-        if (seen.has(key)) found.push(`${where}, the same route twice`);
-        seen.add(key);
-    }
-
-    return found;
-}
-
-function firewallGaps(device: Device): string[] {
-    const found: string[] = [];
-    const fw = device.firewall;
-    if (!fw) return found;
-
-    if (fw.filter?.output) found.push("firewall.filter.output, the platform filters no traffic it sends itself");
-    if (fw.untracked) found.push("firewall.untracked, every session is tracked");
-
-    for (const helper of fw.helpers ?? []) {
-        if (!HELPERS[helper]) found.push(`firewall.helpers ${helper}, the platform has no helper for it`);
-    }
-
-    for (const chain of ["forward", "input"] as const) {
-        (fw.filter?.[chain]?.rules ?? []).forEach((rule, index) =>
-            found.push(...ruleGaps(`firewall.filter.${chain}[${index}]`, rule, chain, device))
-        );
-    }
-
-    (fw.nat?.source ?? []).forEach((rule, index) => {
-        const where = `firewall.nat.source[${index}]`;
-        const match = rule.match;
-
-        if (familiesOf(device, match).includes("ipv6") && (match?.family === "ipv6" || match?.src || match?.dst)) {
-            found.push(`${where}, IPv6: central NAT translates IPv4`);
-        }
-
-        if (rule.action === "dnat") found.push(`${where}.action dnat, in source NAT`);
-        if (rule.action === "snat" && familyOf(rule.to) === "ipv6") found.push(`${where}.to, IPv6: central NAT translates IPv4`);
-        if (match?.dst_port !== undefined) found.push(`${where}.match.dst_port, central NAT matches the source port only`);
-        if (Array.isArray(match?.src_port)) found.push(`${where}.match.src_port, one port or range`);
-        if (rule.action === "snat" && rule.to_port !== undefined && match?.src_port === undefined)
-            found.push(`${where}.to_port, without match.src_port`);
-        if ((match?.src && match.src_set) || (match?.dst && match.dst_set)) found.push(`${where}.match, a prefix and a set on one side`);
-        if (match?.state || match?.tcp_flags) found.push(`${where}.match.state and tcp_flags`);
-    });
-
-    (fw.nat?.destination ?? []).forEach((rule, index) => {
-        const where = `firewall.nat.destination[${index}]`;
-        const match = rule.match;
-
-        if (rule.action !== "dnat") {
-            found.push(`${where}.action ${rule.action}, in destination NAT`);
-            return;
-        }
-
-        if (!match?.dst || split(match.dst.includes("/") ? match.dst : `${match.dst}/32`).len !== 32) {
-            found.push(`${where}.match.dst, one IPv4 address the virtual IP answers on`);
-        }
-
-        const sources = match?.src ? [match.src] : match?.src_set ? (fw.address_sets?.[match.src_set] ?? []) : [];
-        if (familyOf(rule.to) === "ipv6" || sources.some((source) => familyOf(host(source)) === "ipv6")) found.push(`${where}, IPv6`);
-        if (match?.dst_port !== undefined && Array.isArray(match.dst_port)) found.push(`${where}.match.dst_port, one port or range`);
-        if (match?.dst_port !== undefined && match.protocol !== "tcp" && match.protocol !== "udp") {
-            found.push(`${where}.match.protocol, tcp or udp with a port`);
-        }
-
-        if (match?.dst_port === undefined && (match?.protocol || rule.to_port)) {
-            found.push(`${where}.match.dst_port, a protocol or port is forwarded by its port`);
-        }
-
-        if (match?.src && match.src_set) found.push(`${where}.match, a prefix and a set on one side`);
-
-        for (const field of ["dst_set", "src_port", "out_interface", "state", "tcp_flags", "family"] as const) {
-            if (match?.[field] !== undefined) found.push(`${where}.match.${field}`);
-        }
-    });
-
-    for (const name of Object.keys(fw.address_sets ?? {})) {
-        if (name.length > NAME_LENGTH.object)
-            found.push(`firewall.address_sets.${name}, a name longer than ${NAME_LENGTH.object} characters`);
-        if (name.startsWith("circuit-")) found.push(`firewall.address_sets.${name}, a name Circuit keeps for the sources of management`);
-    }
-
-    return found;
-}
-
-/** A filter rule the platform cannot express. */
-function ruleGaps(where: string, rule: FilterRule<string, string>, chain: "forward" | "input", device: Device): string[] {
-    const found: string[] = [];
-    const match = rule.match;
-    const state = match?.state ?? [];
-
-    // The platform is stateful: replies pass on their own, and a rule matches a session's first packet.
-    if (state.some((one) => one === "invalid" || one === "untracked")) found.push(`${where}.match.state ${state.join(", ")}`);
-    else if (state.length && rule.action !== "accept") found.push(`${where}.match.state, on a rule that does not accept`);
-
-    if (match?.tcp_flags) found.push(`${where}.match.tcp_flags, the platform matches no TCP flags`);
-    if ((match?.src && match.src_set) || (match?.dst && match.dst_set)) found.push(`${where}.match, a prefix and a set on one side`);
-    if (isImplied(rule)) return found;
-
-    const families = familiesOf(device, match);
-    if (!families.length) found.push(`${where}, its addresses share no family`);
-
-    if (match?.src && match.dst && familyOf(host(match.src)) !== familyOf(host(match.dst))) {
-        found.push(`${where}, a source and destination of two families`);
-    }
-
-    for (const family of families) {
-        if (serviceOf(match, family).name.length > NAME_LENGTH.object) found.push(`${where}.match ports, too many for one service`);
-    }
-
-    if (chain === "input") {
-        if (match?.out_interface) found.push(`${where}.match.out_interface, on traffic to the device`);
-        if (rule.action === "reject") found.push(`${where}.action reject, the platform drops traffic to itself silently`);
-        if (rule.offload) found.push(`${where}.offload, on traffic to the device`);
-    }
-
-    return found;
-}
-
-function serviceGaps(device: Device): string[] {
-    const found: string[] = [];
-
-    for (const [name, server] of Object.entries(device.dhcp ?? {})) {
-        if (familyOf(host(server.network)) === "ipv6") found.push(`dhcp.${name}.network, IPv6: DHCPv6 hands out no gateway`);
-        if ((server.dns?.length ?? 0) > RESOLVERS.dhcp) found.push(`dhcp.${name}.dns, at most ${RESOLVERS.dhcp}`);
-    }
-
-    const flow = device.flow_export;
-    if (flow?.protocol === "ipfix") found.push("flow_export.protocol ipfix, the platform exports sFlow and NetFlow 9");
-    if (flow && flow.collectors.length > 1) found.push("flow_export.collectors, one collector");
-    for (const name of flow?.interfaces ?? []) {
-        const type = device.interfaces?.[name]?.type;
-        if (type === "gre" || type === "vxlan")
-            found.push(`flow_export.interfaces ${name}, a tunnel: the platform samples the interface it leaves through`);
-    }
-    if (flow?.protocol === "netflow-v9" && flow.sampling !== undefined) found.push("flow_export.sampling, NetFlow here exports every flow");
-    if (flow?.protocol === "sflow" && (flow.sampling === undefined || flow.sampling < 10 || flow.sampling > 99999)) {
-        found.push("flow_export.sampling, required and from 10 to 99999: the platform samples");
-    }
-
-    return found;
-}
-
-export const fortios: DeviceAdapter = {
-    extension: ".conf",
-    console: true,
-    unsupported,
-    render,
-    read,
-    plan,
-    apply,
-    fill,
-};