@takodotid/circuit 0.34.3 → 0.36.0

package/src/platforms/raisecom-ros/render.ts

@@ -0,0 +1,328 @@
+import { Address } from "../../core/address";
+import { Secrets } from "../../core/secrets";
+import { Utils } from "../../core/utils";
+import type { Device, Ethertype, Port, Prefix, Severity, SnmpUser, Switched, Vrrp } from "../../schema";
+import { Catalog } from "../catalog";
+import { Derive } from "../derive";
+
+type AnyPort = Port<string, string, string, string>;
+
+/** The configuration a Raisecom ROS device should run. */
+export class RaisecomRosRender {
+    /** The access-list that guards every management service. */
+    static readonly MANAGEMENT_ACL = 1000;
+
+    /** The access-list that guards SNMP when it has sources of its own. */
+    static readonly SNMP_ACL = 1001;
+
+    /** A log level as the platform prints it, a number. It takes the names too (`warnings`), but prints the number. */
+    private static readonly LOG_LEVELS: Record<Severity, number> = {
+        emergency: 0,
+        alert: 1,
+        critical: 2,
+        error: 3,
+        warning: 4,
+        notice: 5,
+        info: 6,
+        debug: 7,
+    };
+
+    /** The most MAC addresses port security takes on a port, and its default. */
+    static readonly MAC_LIMIT_MAX = 1024;
+
+    /** A kind of frame as a MAC access-list rule matches it, in the form the device prints. It takes a type as hex without `0x`, and names IPv4 and ARP. */
+    private static readonly ETHERTYPES: Record<Ethertype, string> = { ipv4: "ip", arp: "arp", ipv6: "86dd ffff" };
+
+    /** The log level and UDP port a log host has unless told otherwise. Neither prints. */
+    private static readonly LOG_DEFAULTS = { level: 6, port: 514 };
+
+    /** The SNMPv3 authentication each `auth` takes on this platform. One missing here cannot be expressed. */
+    static readonly SNMP_AUTH: Partial<Record<SnmpUser["auth"], string>> = { sha1: "sha" };
+
+    /** The OSPF process number. */
+    private static readonly OSPF_PROCESS = 1;
+
+    /** The SNMPv3 access group every user belongs to, read-only on the whole tree. */
+    private static readonly SNMP_GROUP = "circuit";
+
+    /** `99,200-201,999`, the platform's compression of a VLAN list. */
+    static vlanList(ids: number[]): string {
+        const sorted = [...new Set(ids)].sort((a, b) => a - b);
+        const ranges: string[] = [];
+
+        for (let i = 0; i < sorted.length; i++) {
+            let end = i;
+            while (sorted[end + 1] === sorted[end]! + 1) end++;
+            ranges.push(i === end ? `${sorted[i]}` : `${sorted[i]}-${sorted[end]}`);
+            i = end;
+        }
+
+        return ranges.join(",");
+    }
+
+    /** The whole configuration of a device. */
+    static of(device: Device): string {
+        const lines: string[] = [];
+        const vlans = device.vlans ?? {};
+        const vlanId = (name: string) => vlans[name]!.id;
+        const management = device.management ?? {};
+        const allow = management.allow ?? [];
+
+        const ids = Object.values(vlans).map((vlan) => vlan.id);
+        if (ids.length) lines.push(`create vlan ${RaisecomRosRender.vlanList(ids)} active`, "!");
+
+        const lagNumbers = Derive.lagIds(device);
+
+        for (const [name, lag] of Object.entries(device.interfaces ?? {})) {
+            if (lag.type !== "lag") continue;
+
+            lines.push(`interface port-channel ${lagNumbers.get(name)}`);
+            if (lag.description) lines.push(`description ${lag.description}`);
+            if (lag.mode === "static") lines.push("mode manual");
+            lines.push(...RaisecomRosRender.switching(lag, vlanId), "!");
+        }
+
+        if (allow.length) lines.push(...RaisecomRosRender.accessList(RaisecomRosRender.MANAGEMENT_ACL, "management", allow));
+        const snmpSources = management.snmp?.allow;
+        if (snmpSources) lines.push(...RaisecomRosRender.accessList(RaisecomRosRender.SNMP_ACL, "snmp", snmpSources));
+
+        const ports = Catalog.ports(device.platform, device.model);
+
+        // Each port that takes only some kinds of frame has a MAC access-list of its own, so changing one releases only that port.
+        ports.forEach((port, index) => {
+            const ethertypes = device.ports?.[port as keyof typeof device.ports]?.ethertypes;
+            if (!ethertypes) return;
+
+            lines.push(`access-list ${RaisecomRosRender.ethertypeAcl(index)}`);
+            ethertypes.forEach((type, rule) =>
+                lines.push(`  rule ${(rule + 1) * 10} permit any any ethertype ${RaisecomRosRender.ETHERTYPES[type]}`)
+            );
+            lines.push("  rule 100 deny any any", "!");
+        });
+
+        for (const [name, user] of Object.entries(device.users ?? {}))
+            lines.push(`user name ${name} password ${Secrets.marker(user.password)}`);
+        if (management.privilege_password) lines.push(`enable password ${Secrets.marker(management.privilege_password)}`);
+        lines.push(`hostname ${device.name}`);
+
+        const timezone = device.system?.timezone;
+        if (timezone) {
+            const minutes = Utils.timeZoneOffset(timezone);
+            const absolute = Math.abs(minutes);
+            lines.push(`clock timezone ${minutes < 0 ? "-" : "+"} ${Math.floor(absolute / 60)} ${absolute % 60} 0`);
+        }
+
+        lines.push("!");
+
+        ports.forEach((port, index) => {
+            const settings = device.ports?.[port as keyof typeof device.ports];
+            lines.push(
+                `interface ${Catalog.spell(device.platform, device.model, port)}`,
+                ...RaisecomRosRender.physicalPort(settings, vlanId, lagNumbers),
+                ...(settings?.ethertypes ? [`filter ingress access-list ${RaisecomRosRender.ethertypeAcl(index)}`] : []),
+                "!"
+            );
+        });
+
+        const ospf = device.routing?.ospf;
+
+        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+            if (iface.type !== "vlan") continue;
+
+            lines.push(`interface vlan ${vlanId(iface.vlan)}`);
+
+            for (const entry of iface.addresses ?? []) {
+                const address = typeof entry === "string" ? entry : entry.address;
+                if (Address.family(address) === "ipv4")
+                    lines.push(`ip address ${Address.host(address)} ${Address.netmask(Address.split(address).len)}`);
+            }
+
+            const ospfSettings = Object.values(ospf?.areas ?? {}).find((area) => area.interfaces[name])?.interfaces[name];
+            if (ospfSettings?.network === "point-to-point") lines.push("ip ospf network ptp");
+            if (ospfSettings?.cost !== undefined) lines.push(`ip ospf cost ${ospfSettings.cost}`);
+            if (ospfSettings?.passive) lines.push("ip ospf passive-interface enable");
+            if (ospfSettings?.bfd) lines.push("ip ospf bfd");
+
+            for (const group of iface.vrrp ?? []) lines.push(...RaisecomRosRender.vrrp(group));
+
+            lines.push("!");
+        }
+
+        if (ospf) {
+            const routerId = device.routing?.router_id;
+            lines.push(`router ospf ${RaisecomRosRender.OSPF_PROCESS}${routerId ? ` router-id ${routerId}` : ""}`);
+
+            for (const [areaId, area] of Object.entries(ospf.areas)) {
+                for (const iface of Object.keys(area.interfaces)) {
+                    for (const prefix of Derive.ipv4Networks(device, iface)) {
+                        lines.push(`network ${Address.host(prefix)} ${Address.wildcard(Address.split(prefix).len)} area ${areaId}`);
+                    }
+                }
+            }
+
+            for (const source of ospf.redistribute ?? []) lines.push(`redistribute ${source}`);
+            lines.push("!");
+        }
+
+        // Storm control acts only once detection is on.
+        if (Object.values(device.ports ?? {}).some((port) => port?.storm_control)) lines.push("storm-control detection enable");
+        if (device.system?.transceiver_monitoring) lines.push("transceiver ddm enable");
+        // LLDP and spanning tree are off by default and turned on by the config.
+        if (device.lldp) lines.push("lldp enable");
+        if (device.stp) {
+            lines.push("spanning-tree enable");
+            if (device.stp.priority !== undefined) lines.push(`spanning-tree priority ${device.stp.priority}`);
+        }
+
+        // The factory communities survive a reset, and one of them can write, so they are always removed.
+        lines.push("no snmp-server community public", "no snmp-server community private");
+        const snmp = management.snmp;
+        if (snmp?.community) lines.push(`snmp-server community ${Secrets.marker(snmp.community)} ro`);
+
+        const snmpUsers = Object.entries(snmp?.users ?? {});
+        if (snmpUsers.length) lines.push(`snmp-server access ${RaisecomRosRender.SNMP_GROUP} read internet usm authpriv`);
+
+        for (const [name, user] of snmpUsers) {
+            const authentication = `authentication ${RaisecomRosRender.SNMP_AUTH[user.auth]} ${Secrets.marker(user.auth_password)}`;
+            const privacy = `privacy ${user.privacy} ${Secrets.marker(user.privacy_password)}`;
+            lines.push(
+                `snmp-server user ${name} ${authentication} ${privacy}`,
+                `snmp-server group ${RaisecomRosRender.SNMP_GROUP} user ${name} usm`
+            );
+        }
+
+        const snmpAcl = snmpSources ? RaisecomRosRender.SNMP_ACL : allow.length ? RaisecomRosRender.MANAGEMENT_ACL : undefined;
+        if ((snmp?.community || snmpUsers.length) && snmpAcl) lines.push(`snmp-server access-list ${snmpAcl}`);
+
+        // A static route watched by BFD tracks a BFD session, one per next hop, bound to the VLAN interface the next hop is on.
+        const sessions = RaisecomRosRender.bfdSessions(device);
+
+        for (const [via, session] of sessions) {
+            lines.push(`bfd ${session.id} bind peer-ip ${via} interface vlan ${vlanId(session.vlan)}`, "session enable", "!");
+        }
+
+        for (const route of device.routing?.static ?? []) {
+            const { addr, len } = Address.split(route.prefix);
+            if (Address.family(addr) !== "ipv4" || !route.via) continue;
+
+            const session = route.bfd ? sessions.get(route.via) : undefined;
+            lines.push(`ip route ${addr} ${Address.netmask(len)} ${route.via}${session ? ` track bfd ${session.id}` : ""}`);
+        }
+
+        if (management.telnet) {
+            lines.push("telnet-server enable");
+            if (allow.length) lines.push(`telnet-server access-list ${RaisecomRosRender.MANAGEMENT_ACL}`);
+        } else lines.push("telnet-server disable");
+
+        const ssh = management.ssh;
+        if (ssh?.auth_timeout) lines.push(`ssh2 server authentication-timeout ${ssh.auth_timeout}`);
+        if (ssh?.auth_retries) lines.push(`ssh2 server authentication-retries ${ssh.auth_retries}`);
+        if (ssh && allow.length) lines.push(`ssh2 access-list ${RaisecomRosRender.MANAGEMENT_ACL}`);
+
+        const ntp = device.system?.ntp;
+        if (ntp?.servers.length) lines.push("ntp enable", ...ntp.servers.map((server) => `ntp server ${server}`));
+
+        for (const host of device.system?.logging?.remote ?? []) {
+            const level = RaisecomRosRender.LOG_LEVELS[host.level];
+            const port = host.port ?? RaisecomRosRender.LOG_DEFAULTS.port;
+            let line = `logging host ${host.address}`;
+            if (level !== RaisecomRosRender.LOG_DEFAULTS.level) line += ` ${level}`;
+            if (port !== RaisecomRosRender.LOG_DEFAULTS.port) line += ` udpport ${port}`;
+            lines.push(line);
+        }
+
+        return lines.join("\n") + "\n";
+    }
+
+    /** An access-list permitting `sources`, then denying the rest. Its description takes one word. */
+    private static accessList(number: number, description: string, sources: readonly Prefix[]): string[] {
+        const rules = sources.map(
+            (cidr, index) => `  rule ${(index + 1) * 10} permit ${Address.host(cidr)} ${Address.netmask(Address.split(cidr).len)}`
+        );
+
+        // Stated, so the list reads the same without knowing the firmware's implicit end.
+        return [`access-list ${number}`, `  description ${description}`, ...rules, "  rule 100 deny any", "!"];
+    }
+
+    /** Access or trunk membership, for a port or a LAG. */
+    private static switching(settings: Switched<string>, vlanId: (name: string) => number): string[] {
+        const lines: string[] = [];
+        if (settings.access_vlan) lines.push(`switchport access vlan ${vlanId(settings.access_vlan)}`);
+
+        if (settings.trunk_vlans) {
+            if (settings.native_vlan) lines.push(`switchport trunk native vlan ${vlanId(settings.native_vlan)}`);
+            lines.push(
+                `switchport trunk allowed vlan ${RaisecomRosRender.vlanList(settings.trunk_vlans.map(vlanId))}`,
+                "switchport mode trunk"
+            );
+        }
+
+        return lines;
+    }
+
+    /** A VRRP group. The platform enables a group once it has an address, and preempts unless told not to. */
+    private static vrrp(group: Vrrp): string[] {
+        const lines = [`vrrp ${group.id} ip ${group.address}`];
+        if (group.interval !== undefined && group.interval !== 1)
+            lines.push(`vrrp ${group.id} timers advertise-interval ${group.interval}`);
+        if (group.priority !== undefined && group.priority !== 100) lines.push(`vrrp ${group.id} priority ${group.priority}`);
+        if (!group.preempt) lines.push(`no vrrp ${group.id} preempt`);
+        return lines;
+    }
+
+    /** A port the config does not declare is shut down. A LAG member holds its membership and description; the LAG holds the rest. */
+    private static physicalPort(
+        settings: AnyPort | undefined,
+        vlanId: (name: string) => number,
+        lagNumbers: Map<string, number>
+    ): string[] {
+        if (!settings) return ["shutdown"];
+
+        const lines: string[] = [];
+        if (settings.description) lines.push(`description ${settings.description}`);
+        if (settings.lag) return [...lines, `port-channel ${lagNumbers.get(settings.lag)}`];
+
+        lines.push(...RaisecomRosRender.switching(settings, vlanId));
+
+        if (settings.lldp === false) lines.push("lldp disable");
+        if (settings.stp === false) lines.push("spanning-tree disable");
+        const broadcast = settings.storm_control?.broadcast;
+        if (broadcast && "pps" in broadcast) lines.push("storm-control mode pps", `storm-control broadcast pps ${broadcast.pps}`);
+
+        // Port security drops frames from any source past the limit (its `protect` action, the default). The most it takes, 1024, is its default and prints nothing.
+        if (settings.mac_limit !== undefined) {
+            lines.push("switchport port-security");
+            if (settings.mac_limit !== RaisecomRosRender.MAC_LIMIT_MAX)
+                lines.push(`switchport port-security maximum ${settings.mac_limit}`);
+        }
+
+        return lines;
+    }
+
+    /** The MAC access-list of the port at `index` in the catalog, for its `ethertypes`. MAC access-lists are 3000 and up. */
+    /** The BFD session for each next hop a static route watches, numbered from 1 in the order the routes come, with the VLAN its interface is on. A next hop on no VLAN interface's network has none. */
+    static bfdSessions(device: Device): Map<string, { id: number; vlan: string }> {
+        const sessions = new Map<string, { id: number; vlan: string }>();
+
+        for (const route of device.routing?.static ?? []) {
+            if (!route.bfd || !route.via || sessions.has(route.via)) continue;
+
+            const holder = Object.values(device.interfaces ?? {}).find(
+                (iface) =>
+                    iface.type === "vlan" &&
+                    (iface.addresses ?? []).some((entry) => {
+                        const address = typeof entry === "string" ? entry : entry.address;
+                        return Address.family(address) === "ipv4" && Address.contains(Address.prefixOf(address), route.via!);
+                    })
+            );
+
+            if (holder?.type === "vlan") sessions.set(route.via, { id: sessions.size + 1, vlan: holder.vlan });
+        }
+
+        return sessions;
+    }
+
+    static ethertypeAcl(index: number): number {
+        return 3001 + index;
+    }
+}

package/src/{adapters/devices → platforms}/routeros/TRAPS.md

@@ -10,7 +10,9 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - `/routing bgp connection add` without `local.role` is refused, so the render always writes one. On 7.23 one without `instance` is refused too, `missing value(s) of argument(s) instance`, although the export never prints `instance=default`.
 - A connection without `input.filter` accepts everything. A neighbor without a policy is given `REJECT-ALL`.
 - A session edited repeatedly can stick: SYN both ways, no RST, no log. Remove the connection and add it again.
-- A session that never established is missing from `/routing bgp session print`; look at `/routing bgp connection print`.
+- A session that never established is missing from `/routing bgp session print`; look at `/routing bgp connection print`. One that is trying prints `established` empty, not `false`, and no uptime (7.23.5).
+- A BGP session is named `<connection>-<n>`, and a renamed connection keeps its session's old name until the session restarts. `circuit bgp` matches a session by the neighbor's address first.
+- `time>` in a `/log print` filter does not filter. `circuit bgp --log` keeps the lines of the last minutes itself, against the device's clock.
 - `tcp-md5-key` set from the CLI has been seen discarded without an error, and a mismatch logs nothing. Confirm with `/tool sniffer quick port=179`.
 - Incoming GRE is subject to the input chain. Accept it before testing the tunnel.
 - A WireGuard peer's name is unique on the device, and a new key under the same name is refused as a new peer, `entry with this name already exists`. The plan finds a peer by name, so a new key is a `set`.
@@ -44,6 +46,18 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - On the serial console, the prompt can come twice after a login. The console echoes a long command wrapped at 80 columns, and a `print` that fills the screen stops at `-- [Q quit|D dump|down]`, where `D` prints the rest.
 - Every VLAN interface on the bridge has the bridge's MAC, and the bridge keeps a frame to that MAC on whatever VLAN it arrives. A gateway in front of a transparent firewall then never gets its replies: they come back on the inside VLAN and stop at the bridge. A MACVLAN on the VLAN interface gives the gateway a MAC of its own, and its replies cross the firewall back; proved with a FortiGate 3700D in transparent mode, the session offloaded to its NP6.
 - A second VLAN interface with the same VLAN ID on the same interface is refused, `already have such vlan`, so a VLAN interface is known by its interface and VLAN ID, and a new name is a rename.
-- A switch rule the chip cannot hold is flagged `I`, invalid, and every rule after it is invalid too, with no log line. On a CCR2216 (98DX8525, 7.23) it came at the sixth distinct `dst-port` range, with 66 rules in all, far below the 1,024 MikroTik lists: the amplifier drops toward every VLAN after it did nothing. Few distinct ranges, and check `print count-only where invalid` after an apply.
+- A switch rule the chip cannot hold is flagged `I`, invalid, and every rule after it is invalid too, with no log line. On a CCR2216 (98DX8525, 7.23) it came at the sixth distinct `dst-port` range, with 66 rules in all, far below the 1,024 MikroTik lists: the amplifier drops toward every VLAN after it did nothing. Few distinct ranges. `apply` counts `print count-only where invalid` after a plan that changed switch rules, and fails when it is not 0. The ranges ran out, not the count: on the same router on 7.23.5, 66 and then 70 rules with two distinct ranges were all valid, `print count-only where invalid` printing `0`. `validate` warns above 5 distinct ranges on a CCR2216.
 - A MACVLAN on a VLAN interface is not routed in the switch chip: its connected route never takes the `H` flag, even with `l3-hw-offloading=yes` on the VLAN under it.
 - A `/system logging` rule naming an action that does not exist yet is refused, `input does not match any value of action`, and `:parse` does not catch it. The action is added first; seen on a CCR2216 on 7.23.5, where the refusal restored the backup.
+- A name is unique in a menu, also where an entry is known by something else: a VLAN interface by its interface and VLAN ID, a BGP connection by its peer address. A new entry under a name the old one still has is refused, and on 7.23.5 the refusal restored the backup and restarted the router. Circuit changes a VLAN interface's VLAN ID with a `set`, so what points at it by name stays attached, and removes any other such entry before adding it again. Proved on a CCR2216 on 7.23.5: the `set vlan-id` took, and the address on the interface stayed.
+- A CCR2216 with 12 active members in one LAG crash-looped, a kernel failure each time LACP formed, for 40 minutes. RouterOS took the 12 in the config and failed only once more than 8 came up. `validate` refuses a LAG of more than 8 on a CCR2216.
+- `/ip neighbor` reports the far port in `interface-name`, which held the far port's description, not its name, from both a Raisecom RAX721 and a FortiGate 3700D (CCR2216, 7.23.5). No other field holds the port. The reader maps a description to the far device's port when exactly one of its ports in the network has it.
+- A neighbor's `interface` is a list: the port, then the LAG and the bridge it is in, `sfp28-1;infra-lag01-fwl;bridge`. Joined to a string in a script, a list repeats the whole line for each of its items; `:tostr` first.
+- LLDP is only received on the interfaces in `discover-interface-list`. On a VLAN interface alone, as the management one, a neighbor that sends untagged LLDP is never seen.
+- A static route's `check-gateway` takes `arp`, `none` or `ping` on 7.23.5, not `bfd`: a bare `bfd` is a syntax error. A quoted value passes `:parse` whatever it is, then the run refuses it, `input does not match any value of check-gateway`; that refusal restored the backup and restarted the router. BFD on a static route stays refused.
+- `/routing bfd configuration interfaces=all` does not cover a multihop session: its BFD session shows `BFD forbidden for destination address`. A configuration with the session's `addresses` makes it active. The render adds one for each multihop session with BFD.
+- A BGP connection with `use-bfd=yes` stays Idle until its BFD session is up, so a peer that does not run BFD never comes up: a multihop session that had been up for hours stayed down five minutes until `use-bfd` went off (CCR2216, 7.23.5). A BGP session asks for BFD only once it has a session; a connection to an address that never answers shows no BFD session at all.
+- BFD timers never set print nothing, and a session then runs at `min-rx=200ms min-tx=200ms multiplier=5`, which print once set. The plan sets them back to those. A multihop BFD session that is down sends once a second whatever its timers.
+- `use-bfd=no`, set on a connection that had `use-bfd=yes`, is printed by the export; it is the default, and the plan sets it to take BFD off.
+- No MAC learning limit on 7.23.5: `/interface bridge port` has `learn` but no limit, and `/interface ethernet switch port` has none (CCR2216). `mac_limit` stays refused.
+- A switch rule matches a kind of frame with `mac-protocol` (`ip`, `ipv6`, `arp` among 23 kinds), but cannot match "not" one. An ethertype filter is a rule that lets each kind through and a last one with an empty `new-dst-ports` for the rest, after the port's ACL rules, which match only `ip` or `ipv6`. Four such rules on a free port took the router to 70 switch rules, none invalid (CCR2216, 7.23.5).