@takodotid/circuit 0.34.3 → 0.36.0

package/src/adapters/devices/routeros/export.ts

@@ -1,321 +0,0 @@
-// Reading an export into commands, and normalising both sides so that only a real difference survives a comparison.
-
-import { network } from "../../../core/addr";
-
-export type Command = {
-    /** The menu the command belongs to, such as `/ip address`. */
-    menu: string;
-    verb: "add" | "set";
-    /** What a `set` addresses: `[ find default-name=ether1 ]`, `ftp`, `1`, or nothing for a menu of one. */
-    selector: string;
-    /** Words without a value, such as `blackhole`. */
-    flags: string[];
-    /** Properties, unquoted and unescaped. */
-    attrs: Record<string, string>;
-};
-
-export type Parsed = {
-    commands: Command[];
-    /** Address lists whose entries are filled by `refresh`, not by the render. */
-    generated: Set<string>;
-};
-
-/** Undo the line wrapping an export applies: a backslash at the end of a line continues it. */
-const unwrap = (text: string) => text.replace(/\r/g, "").replace(/\\\n\s*/g, "");
-
-/** A quoted value without its quotes and escapes. `\_` is an escaped space. */
-function unquote(value: string): string {
-    if (!value.startsWith('"')) return value;
-
-    return value.slice(1, -1).replace(/\\(.)/g, (_, escaped: string) => (escaped === "_" ? " " : escaped));
-}
-
-/** Split a command into words, keeping quoted values and bracketed selectors whole. */
-function words(line: string): string[] {
-    const result: string[] = [];
-    let current = "";
-    let inQuotes = false;
-    let bracketDepth = 0;
-
-    for (let i = 0; i < line.length; i++) {
-        const char = line[i]!;
-        if (inQuotes) {
-            current += char;
-            if (char === "\\") current += line[++i] ?? "";
-            else if (char === '"') inQuotes = false;
-            continue;
-        }
-
-        if (char === '"') inQuotes = true;
-        if (char === "[") bracketDepth++;
-        if (char === "]") bracketDepth--;
-        if (char === " " && bracketDepth === 0) {
-            if (current) result.push(current);
-            current = "";
-            continue;
-        }
-
-        current += char;
-    }
-
-    if (current) result.push(current);
-    return result;
-}
-
-/** One `add` or `set` line into a command. */
-function parseLine(menu: string, line: string): Command {
-    const [verb, ...rest] = words(line) as ["add" | "set", ...string[]];
-
-    let selector = "";
-    const first = rest[0];
-    if (verb === "set" && first && (first.startsWith("[") || !first.includes("="))) {
-        selector = rest.shift()!.replace(/\s+/g, " ");
-    }
-
-    const flags: string[] = [];
-    const attrs: Record<string, string> = {};
-    // A property of the same group as the one before it is written `.name`, which only reads back inside its own command, so it is expanded here.
-    let group = "";
-
-    for (const word of rest) {
-        const equals = word.indexOf("=");
-        if (equals < 0) {
-            flags.push(word);
-            continue;
-        }
-
-        let name = word.slice(0, equals);
-        if (name.startsWith(".")) name = group + name;
-        else if (name.includes(".")) group = name.split(".")[0]!;
-        attrs[name] = unquote(word.slice(equals + 1));
-    }
-
-    return { menu, verb, selector, flags, attrs };
-}
-
-export function parse(text: string): Parsed {
-    const commands: Command[] = [];
-    const generated = new Set<string>();
-    let menu = "";
-
-    for (const raw of unwrap(text).split("\n")) {
-        const line = raw.trim();
-        if (line.startsWith("/")) {
-            menu = line;
-            continue;
-        }
-
-        const marker = /^# generated (\S+)$/.exec(line);
-        if (marker) generated.add(marker[1]!);
-        if (menu && /^(add|set)( |$)/.test(line)) commands.push(parseLine(menu, line));
-    }
-
-    return { commands, generated };
-}
-
-/**
- * Values the platform holds when nothing was set, per menu, and under `*` for every menu.
- *
- * A property at its default is dropped from both sides of a comparison, and this is the value a property the config does not state is reset to. A property the device holds that is not here cannot be reset, which the plan reports as a problem.
- */
-export const DEFAULTS: Record<string, Record<string, string>> = {
-    "*": { disabled: "no", comment: "", instance: "default", "routing-table": "main", vrf: "main" },
-    "/interface bridge": { "protocol-mode": "rstp", priority: "0x8000", "vlan-filtering": "no", pvid: "1" },
-    "/interface bridge port": { pvid: "1", "frame-types": "admit-all", edge: "auto", "path-cost": "10", priority: "0x80" },
-    "/interface bonding": { mode: "balance-rr", "transmit-hash-policy": "layer-2", mtu: "1500" },
-    "/interface ethernet": { mtu: "1500", "auto-negotiation": "yes" },
-    "/interface ethernet switch port": {
-        "storm-rate": "100",
-        "limit-broadcasts": "yes",
-        "limit-unknown-multicasts": "no",
-        "limit-unknown-unicasts": "no",
-    },
-    "/interface vlan": { "l3-hw-offloading": "yes", mtu: "1500" },
-    "/interface macvlan": { mode: "bridge", mtu: "1500" },
-    "/interface vrrp": { priority: "100", "preemption-mode": "yes", interval: "1s", version: "3", "v3-protocol": "ipv4" },
-    "/interface vxlan": { port: "4789" },
-    "/interface wireguard peers": {
-        "client-allowed-address": "",
-        "endpoint-address": "",
-        "endpoint-port": "0",
-        "persistent-keepalive": "0s",
-    },
-    "/ipv6 address": { advertise: "yes" },
-    "/ip dhcp-server": { "lease-time": "30m" },
-    "/ip dns": { servers: "", "allow-remote-requests": "no" },
-    "/ip service": { address: "", certificate: "none" },
-    "/ip ssh": { "strong-crypto": "no" },
-    "/ip traffic-flow": { enabled: "no", interfaces: "all", "packet-sampling": "no" },
-    "/tool mac-server": { "allowed-interface-list": "all" },
-    "/tool mac-server mac-winbox": { "allowed-interface-list": "all" },
-    "/tool mac-server ping": { enabled: "yes" },
-    "/tool bandwidth-server": { enabled: "yes" },
-    "/ip neighbor discovery-settings": { "discover-interface-list": "!dynamic", protocol: "cdp,lldp,mndp" },
-    "/snmp": { enabled: "no", contact: "", location: "" },
-    "/snmp community": {
-        addresses: "::/0",
-        name: "public",
-        security: "none",
-        "authentication-protocol": "MD5",
-        "encryption-protocol": "DES",
-        "read-access": "yes",
-        "write-access": "no",
-    },
-    "/ip settings": { "send-redirects": "yes", "tcp-syncookies": "no" },
-    "/system clock": { "time-zone-autodetect": "yes", "time-zone-name": "manual" },
-    "/system note": { note: "", "show-at-login": "yes" },
-    "/system ntp client": { enabled: "no" },
-    "/system ntp server": { enabled: "no" },
-    "/system logging action": { "disk-file-count": "2", "disk-lines-per-file": "1000" },
-    "/system package update": { channel: "stable" },
-    "/system routerboard settings": { "enter-setup-on": "any-key" },
-    "/interface ethernet switch": { "l3-hw-offloading": "no" },
-    "/interface ethernet switch l3hw-settings": { autorestart: "no", "ipv6-hw": "no" },
-};
-
-/** Whether each `/ip service` ships disabled. */
-const SERVICE_DISABLED: Record<string, string> = {
-    ftp: "no",
-    ssh: "no",
-    telnet: "no",
-    www: "no",
-    "www-ssl": "yes",
-    "reverse-proxy": "no",
-    winbox: "no",
-    api: "no",
-    "api-ssl": "no",
-};
-
-/** Helpers of `/ip firewall service-port` that ship disabled. The rest ship enabled. */
-const HELPER_DISABLED: Record<string, string> = { irc: "yes", rtsp: "yes" };
-
-/** The default of one property of a command, or undefined when it is not known. */
-export function defaultOf(command: Command, property: string): string | undefined {
-    if (command.menu === "/ip service" && property === "disabled") return SERVICE_DISABLED[command.selector];
-
-    if (command.menu === "/ip firewall service-port" && property === "disabled") return HELPER_DISABLED[command.selector] ?? "no";
-
-    return DEFAULTS[command.menu]?.[property] ?? DEFAULTS["*"]![property];
-}
-
-/** A property the device stops printing once another returns to its default. Resetting that other one clears it, so it is never reset on its own. */
-export const CLEARED_WITH: Record<string, Record<string, string>> = {
-    "/interface ethernet": { speed: "auto-negotiation" },
-};
-
-/** Properties whose value cannot be read back from the device. They are compared only by the presence of what holds them. */
-export const SECRET_KEYS = new Set(["private-key", "password", "tcp-md5-key", "authentication-password", "encryption-password"]);
-
-/** How the renderer writes a secret. */
-export const isSecretMarker = (value: string) => value.startsWith("<secret:");
-
-/** A filter rule as the platform prints it, with its own spacing, squeezed so that only a real change survives. */
-const canonicalRule = (rule: string) =>
-    rule
-        .replace(/\s*([=&|;{}(),<>!]+)\s*/g, "$1")
-        .replace(/\s+/g, " ")
-        .trim();
-
-/** One property value in the form both sides compare in. */
-function normalValue(command: Command, property: string, value: string): string {
-    if (property === "rule") return canonicalRule(value);
-    // A list whose order means nothing.
-    if (property === "tagged" || property === "untagged" || property === "slaves") return value.split(",").sort().join(",");
-
-    const onInterface = property === "address" && (command.menu === "/ip address" || command.menu === "/ipv6 address");
-    // An IP address property, which a MAC address is not.
-    const isAddress = /(^|-)address$/.test(property) && !property.endsWith("mac-address");
-    // On an interface, a bare address is shorthand for /32 on IPv4 and /64 on IPv6.
-    if (onInterface && !value.includes("/")) return `${value}/${value.includes(":") ? 64 : 32}`;
-    // Elsewhere a host is printed bare on IPv4 and with /128 on IPv6.
-    if (!onInterface && isAddress && /^[\d.]+\/32$/.test(value)) return value.slice(0, -3);
-
-    if (!onInterface && isAddress && value.includes(":") && !value.includes("/") && !value.includes(",")) return `${value}/128`;
-
-    return value;
-}
-
-/** A command's properties without defaults or secrets, in the form both sides compare in. */
-export function normal(command: Command): Record<string, string> {
-    const result: Record<string, string> = {};
-
-    for (const [property, raw] of Object.entries(command.attrs)) {
-        if (SECRET_KEYS.has(property) || isSecretMarker(raw)) continue;
-
-        const value = normalValue(command, property, raw);
-        if (value === defaultOf(command, property)) continue;
-
-        result[property] = value;
-    }
-    // The platform prints the network it derived from an address. Only a network it could not derive says something.
-    if (command.menu === "/ip address" && result.network && result.address && network(result.address).split("/")[0] === result.network)
-        delete result.network;
-    return result;
-}
-
-/** Properties that tell two `add` entries of a menu apart. `name` where the menu is not listed. */
-const IDENTITY: Record<string, string[]> = {
-    "/interface list member": ["list", "interface"],
-    "/ip firewall address-list": ["list", "address"],
-    "/ipv6 firewall address-list": ["list", "address"],
-    "/interface bridge port": ["interface"],
-    "/interface bridge vlan": ["vlan-ids"],
-    // One VLAN ID per interface: the device refuses a second, so a rename, such as one a MAC of its own brings, is a rename.
-    "/interface vlan": ["interface", "vlan-id"],
-    "/interface vxlan vteps": ["interface", "remote-ip"],
-    "/routing bgp connection": ["remote.address"],
-    "/routing rpki": ["address"],
-    "/routing ospf interface-template": ["area", "interfaces"],
-    "/routing bfd configuration": ["interfaces"],
-    "/ip route": ["dst-address", "routing-table"],
-    "/ipv6 route": ["dst-address", "routing-table"],
-    "/ip address": ["address"],
-    "/ipv6 address": ["address"],
-    "/ip dhcp-server network": ["address"],
-    "/ip dhcp-server lease": ["address"],
-    "/ip traffic-flow target": ["dst-address", "port"],
-    "/system ntp client servers": ["address"],
-    "/system logging": ["action", "topics"],
-    "/user ssh-keys": ["user", "key"],
-};
-
-/** What identifies an `add` entry, so that the same entry is found on both sides. */
-export function identity(command: Command): Record<string, string> {
-    // The switching bridge is the one that filters VLANs, whatever it is called, so a rename is a rename and not a rebuild of every port.
-    if (command.menu === "/interface bridge" && command.attrs["vlan-filtering"] === "yes") return { "vlan-filtering": "yes" };
-
-    const normalized = normal(command);
-    const properties = IDENTITY[command.menu] ?? ["name"];
-    const result: Record<string, string> = {};
-
-    for (const property of properties) {
-        const value = normalized[property] ?? command.attrs[property] ?? defaultOf(command, property) ?? "";
-        result[property] = value;
-    }
-
-    return result;
-}
-
-/** Menus whose entries are an ordered list without names. They are rewritten whole, in the order the render gives. */
-export const ORDERED = new Set([
-    "/routing filter rule",
-    "/ip firewall filter",
-    "/ipv6 firewall filter",
-    "/ip firewall nat",
-    "/ipv6 firewall nat",
-    "/ip firewall mangle",
-    "/ipv6 firewall mangle",
-    "/ip firewall raw",
-    "/ipv6 firewall raw",
-    "/interface bridge filter",
-    "/interface ethernet switch rule",
-]);
-
-/** One command as a string that is equal for equal commands. */
-export function canonical(command: Command): string {
-    const properties = Object.entries(normal(command))
-        .sort(([a], [b]) => a.localeCompare(b))
-        .map(([name, value]) => `${name}=${value}`);
-    const flags = [...command.flags].sort();
-    return [command.verb, command.selector, ...flags, ...properties].filter(Boolean).join(" ");
-}

package/src/adapters/devices/routeros/index.ts

@@ -1,346 +0,0 @@
-// RouterOS 7: logging in, reading, the fields it cannot express, and sending a plan.
-//
-// The platform applies every command the moment it arrives and has no candidate configuration, so a run is guarded three ways. Every command is first compiled on the device without running, so a syntax error or an unknown property costs nothing. A backup is saved and a scheduler armed to restore it, and the run must log in again in a fresh session before the scheduler is removed. A command the device refuses restores the backup at once, rather than leaving the device half applied.
-
-import type { Client } from "ssh2";
-import { familyOf } from "../../../core/addr";
-import { resolve, substitute } from "../../../core/secrets";
-import type { Device, Family } from "../../../schema";
-import { type ConsoleDialect, consoleLogin, consoleOf, ConsoleShell, openConsole } from "../../../transport/console";
-import { connect, exec, managementHost, upload } from "../../../transport/ssh";
-import type { ApplyOptions, DeviceAdapter, Plan, ReadOptions } from "../types";
-import { INSTALL_CERTIFICATE, plan } from "./plan";
-import { spell } from "../catalog";
-import { mediumOf, render } from "./render";
-
-/** The major version this adapter renders for. Version 6 has a different BGP and filter language altogether. */
-export const SUPPORTED_MAJOR = 7;
-
-export async function login(device: Device): Promise<Client> {
-    const user = device.users?.[device.connection.user];
-    if (!user) throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
-
-    return connect({
-        host: managementHost(device),
-        port: device.connection.port,
-        user: device.connection.user,
-        password: resolve(user.password),
-    });
-}
-
-/** How the RouterOS console asks for a login. The flags after the user turn off colours and terminal detection, without which the console redraws every line. */
-export const ROUTEROS_CONSOLE: ConsoleDialect = {
-    login: /Login: $/,
-    password: /Password: $/,
-    prompt: /\] > $/,
-    logout: "/quit",
-    others: [
-        [/-- \[Q quit\|D dump\|(?:C-z pause\|)?down\]$/, "D"],
-        [/\[Y\/n\]:? ?$/, "n"],
-    ],
-    user: (user) => `${user}+cwt`,
-};
-
-/** Where commands run, one at a time, each returning what it printed: an SSH session, or the console. */
-type Session = {
-    run(command: string, timeout?: number): Promise<string>;
-    /** Write a file to the device. Only SSH can. */
-    upload?(path: string, content: string): Promise<void>;
-    /** A fresh login, which proves access survived: this session ends and a new SSH session opens, or the console logs out and in again. */
-    fresh(): Promise<Session>;
-    end(): void;
-};
-
-function sshSession(client: Client, device: Device): Session {
-    return {
-        run: (command, timeout) => exec(client, command, timeout),
-        upload: (path, content) => upload(client, path, content),
-        fresh: async () => {
-            client.end();
-            return sshSession(await login(device), device);
-        },
-        end: () => client.end(),
-    };
-}
-
-async function consoleSession(device: Device): Promise<Session> {
-    const { console, user, password } = consoleOf(device);
-    const opened = await openConsole(console);
-
-    try {
-        await consoleLogin(opened.channel, ROUTEROS_CONSOLE, user, password, console.passwordOnly);
-    } catch (error) {
-        opened.close();
-        throw error;
-    }
-
-    const shell = new ConsoleShell(opened.channel, ROUTEROS_CONSOLE);
-
-    const session: Session = {
-        run: (command, timeout) => shell.run(command, timeout),
-        fresh: async () => {
-            await consoleLogin(opened.channel, ROUTEROS_CONSOLE, user, password, console.passwordOnly);
-            return session;
-        },
-        end: () => {
-            shell.logout();
-            opened.close();
-        },
-    };
-
-    return session;
-}
-
-/** Log in over SSH, or on the console when asked. */
-async function open(device: Device, options: ReadOptions = {}): Promise<Session> {
-    return options.console ? consoleSession(device) : sshSession(await login(device), device);
-}
-
-/** Refuse a device on a version this adapter does not render for, before anything is read or sent. */
-export async function checkVersion(session: Session, device: Device): Promise<void> {
-    const version = (await session.run(":put [/system resource get version]")).trim();
-    const major = Number(version.split(".")[0]);
-
-    if (major !== SUPPORTED_MAJOR) {
-        throw new Error(`${device.name} runs RouterOS ${version}; this adapter renders for version ${SUPPORTED_MAJOR}`);
-    }
-}
-
-/** Both dumps stamp the time they were taken. Without the stamp, an unchanged device reads the same twice. */
-const EXPORT_TIMESTAMP = /^# \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} by RouterOS/m;
-
-const withoutTimestamp = (text: string) => text.replace(/\r/g, "").replace(EXPORT_TIMESTAMP, "# by RouterOS");
-
-/** Lists certificates in the form the renderer writes them, since an export does not include them. One line, because a script sent over exec runs as one. */
-const LIST_CERTIFICATES = [
-    ":foreach c in=[/certificate find] do={",
-    ':local key "no";',
-    ':if ([/certificate get $c private-key]) do={ :set key "yes" };',
-    ':put ("add fingerprint=" . [/certificate get $c fingerprint] . " name=" . [/certificate get $c name] . " private-key=" . $key)',
-    "}",
-].join(" ");
-
-/**
- * What the device runs: its export, its users, and its certificates. Secrets are not part of an export.
- */
-export async function read(device: Device, _network: readonly Device[] = [], options: ReadOptions = {}): Promise<string> {
-    const session = await open(device, options);
-
-    try {
-        await checkVersion(session, device);
-
-        const config = await session.run("/export", 300_000);
-        const users = await session.run("/user export");
-        const certificates = (await session.run(LIST_CERTIFICATES)).trim();
-
-        const listed = certificates.split("\n").every((line) => line.trim().startsWith("add fingerprint="));
-        if (certificates && !listed) {
-            throw new Error(`${device.name}: certificates could not be listed: ${certificates.slice(0, 120)}`);
-        }
-
-        // The user dump repeats the export's header; only its menu is kept.
-        const userMenu = users.slice(users.indexOf("\n/")).trim();
-        const certificateMenu = certificates ? `/certificate\n${certificates}` : "";
-        const text = [config.trim(), userMenu, certificateMenu].filter(Boolean).join("\n");
-        return withoutTimestamp(text) + "\n";
-    } finally {
-        session.end();
-    }
-}
-
-export function unsupported(device: Device): string[] {
-    const found: string[] = [];
-
-    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-        if (iface.type === "bridge") found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
-    }
-
-    for (const [name, port] of Object.entries(device.ports ?? {})) {
-        if (!port) continue;
-
-        if (port.speed && !mediumOf(spell(device.platform, device.model, name), port.speed)) {
-            found.push(`ports.${name}.speed ${port.speed}, the port has no fixed speed by that name`);
-        }
-
-        const thresholds = Object.values(port.storm_control ?? {});
-        const percents = new Set(thresholds.map((threshold) => ("percent" in threshold ? threshold.percent : undefined)));
-
-        if (thresholds.some((threshold) => "pps" in threshold)) {
-            found.push(`ports.${name}.storm_control in pps, the platform takes percent`);
-        } else if (percents.size > 1) {
-            found.push(`ports.${name}.storm_control with a different percent per kind, the platform takes one`);
-        }
-    }
-
-    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-        if (iface.type !== "lag") continue;
-
-        for (const field of ["storm_control", "stp"] as const) {
-            if (iface[field] !== undefined) found.push(`interfaces.${name}.${field}, on a LAG`);
-        }
-    }
-
-    const bgp = device.routing?.bgp;
-
-    for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
-        const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
-        const families = neighbor.families ?? group?.families ?? [familyOf(neighbor.address)];
-
-        if (families.length > 1) found.push(`routing.bgp.neighbors.${name}.families, one family per session`);
-    }
-
-    const management = device.management;
-
-    if (management?.console) found.push("management.console, the console uses the device's users");
-    if (management?.interfaces) found.push("management.interfaces, which only FortiOS builds for now");
-    if (management?.privilege_password) found.push("management.privilege_password, the platform has no privileged mode");
-
-    if (management?.snmp?.port) found.push("management.snmp.port");
-
-    if (management?.ssh?.auth_timeout || management?.ssh?.auth_retries) {
-        found.push("management.ssh.auth_timeout and auth_retries");
-    }
-
-    for (const [name, user] of Object.entries(management?.snmp?.users ?? {})) {
-        if (user.auth !== "sha1") {
-            found.push(`management.snmp.users.${name}.auth ${user.auth}, the platform authenticates with SHA1 or MD5`);
-        }
-    }
-
-    if (device.system?.transceiver_monitoring === false) found.push("system.transceiver_monitoring false, it is always on");
-    if (device.flow_export?.protocol === "sflow") found.push("flow_export.protocol sflow, the platform exports NetFlow and IPFIX");
-
-    return found;
-}
-
-const ROLLBACK_SCHEDULER = "apply-rollback";
-
-/** Escape a command so it can sit inside a quoted string on the device. */
-const escapeForString = (text: string) => text.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\$/g, "\\$");
-
-/** Compile a command on the device without running it. Returns why it was refused, or undefined. */
-async function refusal(session: Session, command: string): Promise<string | undefined> {
-    const compiled = (await session.run(`:put [:parse "${escapeForString(command)}"]`)).trim();
-    const refused = !compiled.startsWith("(") || /syntax error|bad parameter|no such|expected/.test(compiled);
-    return refused ? compiled.slice(0, 200) : undefined;
-}
-
-/** Upload a certificate and its key, import both under one name, and delete the files. */
-async function installCertificate(session: Session, device: Device, name: string): Promise<void> {
-    const certificate = device.certificates?.[name];
-    if (!certificate) throw new Error(`certificate ${name} is not declared`);
-    if (!session.upload)
-        throw new Error(`certificate ${name} is installed from a file, which only SSH can write; apply it without --console`);
-
-    await session.upload(`${name}.crt`, certificate.certificate);
-    await session.run(`/certificate import file-name=${name}.crt name=${name} passphrase=""`);
-
-    if (certificate.private_key) {
-        // A key from a file is PEM as it is; one from a variable is PEM encoded as one line of base64.
-        const value = resolve(certificate.private_key);
-        const privateKey = value.includes("-----BEGIN") ? `${value}\n` : Buffer.from(value, "base64").toString("utf8");
-
-        await session.upload(`${name}.key`, privateKey);
-        await session.run(`/certificate import file-name=${name}.key name=${name} passphrase=""`);
-    }
-
-    await session.run(`/file remove [find name="${name}.crt" or name="${name}.key"]`);
-}
-
-export async function apply(device: Device, _network: readonly Device[], changes: Plan, options: ApplyOptions): Promise<void> {
-    const session = await open(device, options);
-    await checkVersion(session, device);
-
-    const commands = changes.steps.flatMap((step) => step.send.map((command) => ({ title: step.title, command })));
-
-    for (const { title, command } of commands) {
-        if (command.startsWith(INSTALL_CERTIFICATE)) continue;
-
-        const reason = await refusal(session, substitute(command));
-        if (reason) {
-            session.end();
-            throw new Error(`${title}: the device will not parse ${command.slice(0, 200)}\n    ${reason}`);
-        }
-    }
-
-    const stamp = new Date().toISOString().replace(/[-:T]/g, "").slice(0, 12);
-    const backup = `pre-apply-${stamp}`;
-
-    // `interval` counts from now; `start-time=startup` would count from boot.
-    const armRollback = [
-        `/system scheduler add name="${ROLLBACK_SCHEDULER}"`,
-        `interval=${options.rollback}m`,
-        `on-event="/system backup load name=${backup} password=\\"\\""`,
-        "policy=read,write,policy,test,reboot,ftp",
-    ].join(" ");
-
-    try {
-        console.log(`  saving ${backup}, arming a ${options.rollback} minute rollback`);
-
-        await session.run(`/system backup save name=${backup} dont-encrypt=yes`, 120_000);
-        await session.run(`/system scheduler remove [find name="${ROLLBACK_SCHEDULER}"]`);
-        await session.run(armRollback);
-
-        for (const { title, command } of commands) {
-            if (command.startsWith(INSTALL_CERTIFICATE)) {
-                const certificateName = command.slice(INSTALL_CERTIFICATE.length).trim();
-                await installCertificate(session, device, certificateName);
-                continue;
-            }
-
-            const answer = (await session.run(substitute(command), 120_000)).trim();
-            if (answer) throw new Error(`${title}: ${command.slice(0, 160)}\n    device said: ${answer.slice(0, 300)}`);
-        }
-    } catch (error) {
-        console.log(`  FAILED: ${(error as Error).message}`);
-        console.log(`  restoring ${backup} now; the rollback stays armed in case this does not get through`);
-
-        await session.run(`/system backup load name=${backup} password=""`, 30_000).catch(() => undefined);
-        session.end();
-
-        throw new Error("apply failed and the backup is being restored");
-    }
-
-    // A fresh login is the proof that access survived. Only then is the rollback removed, with the backup, which holds every credential.
-    const proof = await session.fresh().catch(() => undefined);
-    if (!proof) throw new Error(`could not log in again; the device restores ${backup} within ${options.rollback} minutes`);
-
-    await proof.run(`/system scheduler remove [find name="${ROLLBACK_SCHEDULER}"]`);
-    await proof.run(`/file remove [find name="${backup}.backup"]`);
-    proof.end();
-    console.log("  logged in again, rollback disarmed");
-}
-
-/** Replace a list's entries in batches, so each command stays a sane length. */
-export async function fill(device: Device, _network: readonly Device[], set: string, family: Family, prefixes: string[]): Promise<void> {
-    const menu = family === "ipv4" ? "/ip firewall address-list" : "/ipv6 firewall address-list";
-    const batchSize = 60;
-    const client = await login(device);
-
-    try {
-        await exec(client, `${menu} remove [find list="${set}" and !dynamic]`);
-
-        for (let start = 0; start < prefixes.length; start += batchSize) {
-            const batch = prefixes.slice(start, start + batchSize).map((prefix) => `${menu} add list="${set}" address=${prefix}`);
-
-            const answer = (await exec(client, batch.join("; "), 90_000)).trim();
-            if (answer) throw new Error(`${set}: ${answer.slice(0, 200)}`);
-        }
-
-        const count = (await exec(client, `:put [:len [${menu} find list="${set}"]]`)).trim();
-        console.log(`  ${set}: ${count} entries on the device`);
-    } finally {
-        client.end();
-    }
-}
-
-export const routeros: DeviceAdapter = {
-    extension: ".rsc",
-    console: true,
-    unsupported,
-    render,
-    read,
-    plan,
-    apply,
-    fill,
-};