@takodotid/circuit 0.39.0 → 0.40.0

package/dist/cli/index.js

@@ -542,6 +542,8 @@ class Derive {
     const has = (feature) => proved.includes(feature);
     if (routing?.bfd && !has("bfd-timers"))
       found.push(`routing.bfd, BFD timers are ${unproved}`);
+    if (device.vdoms && !has("management-vdom"))
+      found.push(`vdoms, a management VDOM is ${unproved}`);
     for (const route of routing?.static ?? []) {
       if (route.bfd && !has("static-route-bfd"))
         found.push(`routing.static ${route.prefix} bfd, BFD on a static route is ${unproved}`);
@@ -907,6 +909,11 @@ class FortiOsFirewall {
     const state = rule.match?.state;
     return rule.action === "accept" && state !== undefined && state.length > 0 && state.every((one) => one === "established" || one === "related");
   }
+  static managementOnly(root, device) {
+    const localIns = { ipv4: 0, ipv6: 0 };
+    const localInEntry = (family) => root.block(family === "ipv4" ? "firewall local-in-policy" : "firewall local-in-policy6").entry(++localIns[family]);
+    FortiOsFirewall.management(localInEntry, new Objects(root, device), device);
+  }
   static render(root, device) {
     const fw = device.firewall;
     const objects = new Objects(root, device);
@@ -2166,6 +2173,155 @@ class FortiOsPlan {
   }
 }
 
+// src/platforms/fortios/vdoms.ts
+class FortiOsVdoms {
+  static ROOT = "root";
+  static GLOBAL = new Set([
+    "vpn certificate local",
+    "vpn certificate ca",
+    "system global",
+    'system replacemsg admin "pre_admin-disclaimer-text"',
+    "system accprofile",
+    "system admin",
+    "system interface",
+    "system dns",
+    "system ntp",
+    "system snmp sysinfo",
+    "system snmp community",
+    "system snmp user",
+    "log disk setting",
+    ...["", "2", "3", "4"].flatMap((number) => [`log syslogd${number} setting`, `log syslogd${number} filter`]),
+    "system sflow",
+    "system netflow",
+    "system session-helper"
+  ]);
+  static MANAGEMENT_SECTIONS = [
+    "firewall address",
+    "firewall address6",
+    "firewall addrgrp",
+    "firewall addrgrp6",
+    "firewall service custom",
+    "router static",
+    "router static6",
+    "firewall local-in-policy",
+    "firewall local-in-policy6"
+  ];
+  static managementOf(device) {
+    return device.vdoms?.management.name;
+  }
+  static vdomOf(device, name) {
+    const management = device.vdoms?.management;
+    if (!management)
+      return FortiOsVdoms.ROOT;
+    const lag = device.ports?.[name]?.lag;
+    const holder = lag ?? name;
+    return management.interfaces.includes(holder) ? management.name : FortiOsVdoms.ROOT;
+  }
+  static key(vdom, section) {
+    return `@${vdom} ${section}`;
+  }
+  static scopeOf(key) {
+    const named = /^@(\S+) (.+)$/.exec(key);
+    if (named)
+      return { scope: { kind: "vdom", vdom: named[1] }, section: named[2] };
+    return FortiOsVdoms.GLOBAL.has(key) ? { scope: { kind: "global" }, section: key } : { scope: { kind: "vdom", vdom: FortiOsVdoms.ROOT }, section: key };
+  }
+  static isMulti(tree) {
+    return tree.blocks.get("system global")?.settings.get("vdom-mode") === "multi-vdom";
+  }
+  static wrap(scope, lines) {
+    return scope.kind === "global" ? ["config global", ...lines, "end"] : ["config vdom", `edit ${scope.vdom}`, ...lines, "next", "end"];
+  }
+  static named(vdom, text) {
+    return text.replace(/^config /gm, `config @${vdom} `);
+  }
+  static listed(text) {
+    return [...text.matchAll(/^name=([^/\s]+)\//gm)].map((match) => match[1]);
+  }
+  static plan(desired, current, planOne) {
+    const want = FortiOsTree.parse(desired);
+    const have = FortiOsTree.parse(current);
+    const wantMulti = FortiOsVdoms.isMulti(want);
+    const haveMulti = FortiOsVdoms.isMulti(have);
+    const refused = (problem) => ({ steps: [], problems: [problem] });
+    if (wantMulti && !haveMulti) {
+      return refused("the config has vdoms and the device runs one VDOM. Turn multi-VDOM mode on by hand, on the console: `config system global`, `set vdom-mode multi-vdom`, `end`. It moves everything into root and ends every session");
+    }
+    if (!wantMulti && haveMulti) {
+      return refused("the device runs several VDOMs and the config has no vdoms. Write vdoms.management, or turn multi-VDOM mode off by hand");
+    }
+    if (!wantMulti)
+      return planOne(desired, current);
+    const moved = FortiOsVdoms.moved(want, have);
+    if (moved.length) {
+      return refused(`${moved.map(({ name, from, to }) => `${name} from ${from} to ${to}`).join(", ")}: move an interface into another VDOM by hand, on the console, since it may carry the way in`);
+    }
+    const scopes = new Map;
+    const scopeFor = (scope) => {
+      const name = scope.kind === "global" ? "" : scope.vdom;
+      if (!scopes.has(name))
+        scopes.set(name, { scope, want: new FortiOsBlock, have: new FortiOsBlock });
+      return scopes.get(name);
+    };
+    for (const [side, tree] of [
+      ["want", want],
+      ["have", have]
+    ]) {
+      for (const [key, block] of tree.blocks) {
+        const { scope, section } = FortiOsVdoms.scopeOf(key);
+        scopeFor(scope)[side].blocks.set(section, block);
+      }
+    }
+    const global = scopes.get("");
+    const globalPlan = global ? planOne(FortiOsTree.print(global.want), FortiOsTree.print(global.have)) : { steps: [], problems: [] };
+    const inScope = (scope, step) => ({ ...step, send: FortiOsVdoms.wrap(scope, step.send) });
+    const removal = (step) => step.title.endsWith(", removed");
+    const vdomPlans = [...scopes.values()].filter(({ scope }) => scope.kind === "vdom").map(({ scope, want: wanted, have: had }) => ({ scope, plan: planOne(FortiOsTree.print(wanted), FortiOsTree.print(had)) }));
+    const vdomSteps = vdomPlans.flatMap(({ scope, plan }) => plan.steps.map((step) => inScope(scope, { ...step, title: `${scope.kind === "vdom" ? scope.vdom : ""}: ${step.title}` })));
+    return {
+      problems: [...globalPlan.problems, ...vdomPlans.flatMap(({ plan }) => plan.problems)],
+      steps: [
+        ...globalPlan.steps.filter((step) => !removal(step)).map((step) => inScope({ kind: "global" }, step)),
+        ...vdomSteps,
+        ...globalPlan.steps.filter(removal).map((step) => inScope({ kind: "global" }, step))
+      ]
+    };
+  }
+  static moved(want, have) {
+    const wanted = want.blocks.get("system interface");
+    const had = have.blocks.get("system interface");
+    if (!wanted || !had)
+      return [];
+    return [...wanted.entries.entries()].flatMap(([name, { block }]) => {
+      const from = had.entries.get(name)?.block.settings.get("vdom");
+      const to = block.settings.get("vdom");
+      return from && to && FortiOsTree.bare(from) !== FortiOsTree.bare(to) ? [{ name, from: FortiOsTree.bare(from), to: FortiOsTree.bare(to) }] : [];
+    });
+  }
+  static gaps(device) {
+    if (!device.vdoms)
+      return [];
+    const found = [];
+    const tunnels = Object.entries(device.interfaces ?? {}).filter(([, iface]) => iface.type === "gre" || iface.type === "vxlan");
+    if (tunnels.length)
+      found.push(`vdoms with GRE or VXLAN tunnels (${tunnels.map(([name]) => name).join(", ")}), whose tables belong to a VDOM`);
+    if (Object.values(device.interfaces ?? {}).some((iface) => iface.type === "bridge"))
+      found.push("vdoms with a bridge, which needs transparent mode");
+    const management = device.vdoms.management;
+    const inManagement = (name) => name !== undefined && management.interfaces.includes(name);
+    for (const route of device.routing?.static ?? []) {
+      if (inManagement(route.interface))
+        found.push(`routing.static ${route.prefix} leaves through ${route.interface}, in vdoms.management; write it there`);
+    }
+    for (const name of management.interfaces) {
+      const settings = device.interfaces?.[name] ?? device.ports?.[name];
+      if (settings && "vrf" in settings && settings.vrf)
+        found.push(`vdoms.management interface ${name} in VRF ${settings.vrf}`);
+    }
+    return found;
+  }
+}
+
 // src/platforms/fortios/render.ts
 class FortiOsRender {
   static BANNER = 'system replacemsg admin "pre_admin-disclaimer-text"';
@@ -2408,8 +2564,24 @@ class FortiOsRender {
     FortiOsRouting.render(root, device);
     FortiOsRender.helpers(section("system session-helper"), device);
     FortiOsFirewall.render(root, device);
+    FortiOsRender.managementVdom(root, device);
     return FortiOsTree.print(root);
   }
+  static managementVdom(root, device) {
+    const management = device.vdoms?.management;
+    if (!management)
+      return;
+    const vdom = new FortiOsBlock;
+    for (const section of FortiOsVdoms.MANAGEMENT_SECTIONS)
+      vdom.block(section);
+    FortiOsRender.staticRoutes(vdom.block("router static"), vdom.block("router static6"), {
+      ...device,
+      routing: { static: management.static ?? [] }
+    });
+    FortiOsFirewall.managementOnly(vdom, device);
+    for (const [section, block] of vdom.blocks)
+      root.blocks.set(FortiOsVdoms.key(management.name, section), block);
+  }
   static certificates(local, trusted, device) {
     for (const [name, certificate] of Object.entries(device.certificates ?? {})) {
       const text = FortiOsTree.quote(certificate.certificate.trim());
@@ -2445,6 +2617,9 @@ class FortiOsRender {
       block.set("pre-login-banner", "enable");
     if (device.lldp === true)
       block.set("lldp-transmission", "enable").set("lldp-reception", "enable");
+    const vdom = FortiOsVdoms.managementOf(device);
+    if (vdom)
+      block.set("vdom-mode", "multi-vdom").set("management-vdom", FortiOsTree.quote(vdom));
   }
   static users(profiles, admins, device) {
     const roles = new Set(Object.values(device.users ?? {}).map((user) => user.role));
@@ -2471,7 +2646,7 @@ class FortiOsRender {
     for (const port of Catalog.ports(device.platform, device.model)) {
       const settings = device.ports?.[port];
       const entry = block.entry(Catalog.spell(device.platform, device.model, port));
-      entry.set("vdom", FortiOsTree.quote("root"));
+      entry.set("vdom", FortiOsTree.quote(FortiOsVdoms.vdomOf(device, port)));
       entry.set("type", "physical");
       if (!settings) {
         FortiOsRender.redirects(entry, device);
@@ -2495,7 +2670,7 @@ class FortiOsRender {
         continue;
       const members = Object.entries(device.ports ?? {}).filter(([, port]) => port?.lag === name).map(([port]) => Catalog.spell(device.platform, device.model, port));
       const entry = block.entry(name);
-      entry.set("vdom", FortiOsTree.quote("root"));
+      entry.set("vdom", FortiOsTree.quote(FortiOsVdoms.vdomOf(device, name)));
       entry.set("type", "aggregate");
       if (members.length)
         entry.set("member", FortiOsTree.quoteAll(members));
@@ -2513,7 +2688,7 @@ class FortiOsRender {
         continue;
       const parent = FortiOsRender.vlanParent(device, iface.vlan);
       const entry = block.entry(name);
-      entry.set("vdom", FortiOsTree.quote("root"));
+      entry.set("vdom", FortiOsTree.quote(FortiOsVdoms.vdomOf(device, name)));
       if (parent)
         entry.set("interface", FortiOsTree.quote(FortiOsNames.nameOf(device, parent)));
       entry.set("vlanid", device.vlans?.[iface.vlan]?.id ?? 0);
@@ -2531,7 +2706,7 @@ class FortiOsRender {
       if (iface.type !== "loopback")
         continue;
       const entry = block.entry(name);
-      entry.set("vdom", FortiOsTree.quote("root"));
+      entry.set("vdom", FortiOsTree.quote(FortiOsVdoms.vdomOf(device, name)));
       entry.set("type", "loopback");
       if (iface.description)
         entry.set("description", FortiOsTree.quote(iface.description));
@@ -2560,7 +2735,7 @@ class FortiOsRender {
           tunnel.set("dstport", iface.port);
       }
       const entry = block.entry(name);
-      entry.set("vdom", FortiOsTree.quote("root"));
+      entry.set("vdom", FortiOsTree.quote(FortiOsVdoms.vdomOf(device, name)));
       entry.set("type", iface.type === "gre" ? "tunnel" : "vxlan");
       entry.set("interface", via);
       if (iface.type === "vxlan" && iface.mac)
@@ -2949,6 +3124,7 @@ class FortiOs extends Platform {
     if (device.stp)
       found.push("stp, ports are routed");
     found.push(...FortiOs.transparentGaps(device));
+    found.push(...FortiOsVdoms.gaps(device));
     for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
       if (iface.type === "vlan" && iface.mac)
         found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
@@ -2971,7 +3147,8 @@ class FortiOs extends Platform {
   neighbors(device, _network = [], options = {}) {
     return FortiOs.withCli(device, async (cli) => {
       await FortiOs.checkVersion(cli, device);
-      return FortiOs.neighborsOf(await cli.run("diagnose lldprx neighbor details"), device);
+      const details = await FortiOs.inGlobal(cli, device, () => cli.run("diagnose lldprx neighbor details"));
+      return FortiOs.neighborsOf(details, device);
     }, options);
   }
   static neighborsOf(text, device) {
@@ -2994,14 +3171,14 @@ class FortiOs extends Platform {
     return found;
   }
   plan(desired, current, options) {
-    return FortiOsPlan.of(desired, current, options);
+    return FortiOsVdoms.plan(desired, current, (want, have) => FortiOsPlan.of(want, have, options));
   }
   async apply(device, network, changes, options) {
     await FortiOs.applyOnce(device, changes, options);
     const switched = changes.steps.some((step) => step.send.some((line) => line.startsWith("set opmode ")));
     if (!switched)
       return;
-    const again = FortiOsPlan.of(FortiOsRender.of(device), await this.read(device, network, options), options);
+    const again = this.plan(FortiOsRender.of(device), await this.read(device, network, options), options);
     if (!again.steps.length)
       return;
     console.log("  the operation mode changed; applying what it added on its own");
@@ -3010,7 +3187,8 @@ class FortiOs extends Platform {
   async fill(device, _network, set, family, prefixes) {
     await FortiOs.withCli(device, async (cli) => {
       await FortiOs.checkVersion(cli, device);
-      for (const line of FortiOs.fillLines(set, family, prefixes)) {
+      const lines = FortiOs.fillLines(set, family, prefixes);
+      for (const line of device.vdoms ? FortiOsVdoms.wrap({ kind: "vdom", vdom: FortiOsVdoms.ROOT }, lines) : lines) {
         let answer = await cli.run(line);
         if (FortiOsCli.QUESTION.test(cli.prompt) && line === "purge")
           answer = await cli.answer("y");
@@ -3143,6 +3321,18 @@ class FortiOs extends Platform {
     if (`${version[1]}.${version[2]}` !== FortiOs.SUPPORTED) {
       throw new Error(`${device.name} runs FortiOS ${version[1]}.${version[2]}.${version[3]}; this adapter renders for FortiOS ${FortiOs.SUPPORTED}`);
     }
+    return status;
+  }
+  static async inGlobal(cli, device, work) {
+    const multi = typeof device === "boolean" ? device : Boolean(device.vdoms);
+    if (!multi)
+      return work();
+    await cli.run("config global");
+    try {
+      return await work();
+    } finally {
+      await FortiOs.leave(cli);
+    }
   }
   static scrub(text) {
     const root = FortiOsTree.parse(text);
@@ -3166,11 +3356,14 @@ class FortiOs extends Platform {
     return FortiOsTree.print(root);
   }
   static async readConfig(cli, device) {
-    await FortiOs.checkVersion(cli, device);
+    const status = await FortiOs.checkVersion(cli, device);
+    const show = (section) => cli.run(`${FortiOsRender.FULL.includes(section) ? "show full-configuration" : "show"} ${section}`, 120000);
     const parts = [];
-    for (const section of FortiOsRender.SECTIONS) {
-      const show = FortiOsRender.FULL.includes(section) ? "show full-configuration" : "show";
-      parts.push(await cli.run(`${show} ${section}`, 120000));
+    if (/^Virtual domain configuration: (multiple|split-task)/m.test(status)) {
+      parts.push(...await FortiOs.readVdoms(cli, device, show));
+    } else {
+      for (const section of FortiOsRender.SECTIONS)
+        parts.push(await show(section));
     }
     const text = parts.join(`
 `);
@@ -3178,26 +3371,53 @@ class FortiOs extends Platform {
       throw new Error(`${device.name} returned no configuration`);
     return FortiOs.scrub(FortiOsPlan.clean(text));
   }
+  static async readVdoms(cli, device, show) {
+    const management = FortiOsVdoms.managementOf(device);
+    if (!management)
+      throw new Error(`${device.name} runs several VDOMs and its config has no vdoms; write vdoms.management`);
+    const parts = [];
+    const inVdom = async (vdom, sections) => {
+      await cli.run("config vdom");
+      await cli.run(`edit ${vdom}`);
+      try {
+        for (const section of sections) {
+          const text = await show(section);
+          parts.push(vdom === FortiOsVdoms.ROOT ? text : FortiOsVdoms.named(vdom, text));
+        }
+      } finally {
+        await FortiOs.leave(cli);
+      }
+    };
+    const listed = await FortiOs.inGlobal(cli, true, async () => {
+      for (const section of FortiOsRender.SECTIONS.filter((one) => FortiOsVdoms.GLOBAL.has(one)))
+        parts.push(await show(section));
+      return FortiOsVdoms.listed(await cli.run("diagnose sys vd list"));
+    });
+    await inVdom(FortiOsVdoms.ROOT, FortiOsRender.SECTIONS.filter((one) => !FortiOsVdoms.GLOBAL.has(one)));
+    if (listed.includes(management))
+      await inVdom(management, FortiOsVdoms.MANAGEMENT_SECTIONS);
+    return parts;
+  }
   static async leave(cli) {
     for (let level = 0;level < 10 && /\(.*\) [#$] $/.test(cli.prompt); level++)
       await cli.run("end");
   }
-  static async saving(cli, mode, seconds) {
+  static async saving(cli, mode, multi, seconds) {
     const lines = ["config system global", `set cfg-save ${mode}`, ...seconds ? [`set cfg-revert-timeout ${seconds}`] : [], "end"];
-    for (const line of lines) {
+    for (const line of multi ? FortiOsVdoms.wrap({ kind: "global" }, lines) : lines) {
       const answer = await cli.run(line);
       if (FortiOs.REFUSED.test(answer))
         throw new Error(`the device refused ${line}: ${answer.trim().slice(0, 300)}`);
     }
   }
-  static async configure(cli, plan, guard) {
+  static async configure(cli, plan, guard, multi) {
     const minutes = guard.seconds / 60;
-    await FortiOs.saving(cli, "revert", guard.seconds);
+    await FortiOs.saving(cli, "revert", multi, guard.seconds);
     const restore = async (reason) => {
       await FortiOs.leave(cli).catch(() => {
         return;
       });
-      await cli.run("execute cfg reload").catch(() => {
+      await FortiOs.inGlobal(cli, multi, () => cli.run("execute cfg reload")).catch(() => {
         return;
       });
       return new Reloaded(`${reason}
@@ -3231,27 +3451,28 @@ class FortiOs extends Platform {
     } catch (error) {
       throw await restore(`a fresh login failed: ${error.message}`);
     }
-    const saved = await cli.run("execute cfg save", 120000);
+    const saved = await FortiOs.inGlobal(cli, multi, () => cli.run("execute cfg save", 120000));
     if (!/config saved|no config to be saved/.test(saved)) {
       throw new Error(`access was proved but the save failed; the device reverts in ${minutes} minutes:
     ${saved.trim().slice(0, 300)}`);
     }
-    await FortiOs.saving(cli, "automatic");
+    await FortiOs.saving(cli, "automatic", multi);
     console.log("  logged in again, saved");
   }
   static async settle(device, options) {
     for (let attempt = 0;attempt < FortiOs.RELOAD.attempts; attempt++) {
       await new Promise((done) => setTimeout(done, FortiOs.RELOAD.interval));
       const settled = await FortiOs.withCli(device, async (cli) => {
-        if (!/no config to be reloaded/.test(await cli.run("execute cfg reload")))
+        const reloaded = await FortiOs.inGlobal(cli, device, () => cli.run("execute cfg reload"));
+        if (!/no config to be reloaded/.test(reloaded))
           return false;
-        await FortiOs.saving(cli, "automatic");
+        await FortiOs.saving(cli, "automatic", Boolean(device.vdoms));
         return true;
       }, options).catch(() => false);
       if (settled)
         return "the device is back and saves changes on its own again";
     }
-    return "the device did not come back in time and still reverts every change; set `cfg-save automatic` under `config system global`";
+    return "the device did not come back in time and still reverts every change; set `cfg-save automatic` under `config system global` (in `config global` on a device with VDOMs)";
   }
   static async applyOnce(device, plan, options) {
     const seconds = options.rollback * 60;
@@ -3259,7 +3480,7 @@ class FortiOs extends Platform {
       if (options.console) {
         await FortiOs.consoleSession(device, async (cli, relogin) => {
           await FortiOs.checkVersion(cli, device);
-          await FortiOs.configure(cli, plan, { seconds, prove: relogin });
+          await FortiOs.configure(cli, plan, { seconds, prove: relogin }, Boolean(device.vdoms));
         });
         return;
       }
@@ -3271,7 +3492,7 @@ class FortiOs extends Platform {
             const proof = await FortiOs.login(device);
             proof.end();
           }
-        });
+        }, Boolean(device.vdoms));
       });
     } catch (error) {
       if (!(error instanceof Reloaded))
@@ -7901,9 +8122,23 @@ class RouterOsRender {
   }
   untracked(family) {
     const menu = family === "ipv4" ? "/ip firewall raw" : "/ipv6 firewall raw";
-    for (const prefix of this.device.firewall?.untracked ?? []) {
-      if (Address2.family(prefix) !== family)
+    const untracked = (this.device.firewall?.untracked ?? []).filter((prefix) => Address2.family(prefix) === family);
+    for (const address of RouterOsRender.natAddresses(this.device)) {
+      if (Address2.family(address) !== family || !untracked.some((prefix) => Address2.contains(prefix, address)))
         continue;
+      for (const [direction, property] of [
+        ["to", "dst-address"],
+        ["from", "src-address"]
+      ]) {
+        this.add(menu, "add", {
+          action: "accept",
+          chain: "prerouting",
+          comment: `Tracked for NAT, ${direction} ${address}`,
+          [property]: address
+        });
+      }
+    }
+    for (const prefix of untracked) {
       for (const [direction, property] of [
         ["to", "dst-address"],
         ["from", "src-address"]
@@ -7917,6 +8152,17 @@ class RouterOsRender {
       }
     }
   }
+  static natAddresses(device) {
+    const nat = device.firewall?.nat;
+    const addresses = [
+      ...(nat?.source ?? []).flatMap((rule) => rule.action === "masquerade" ? [] : [rule.to]),
+      ...(nat?.destination ?? []).flatMap((rule) => [
+        ...rule.match?.dst ? [rule.match.dst] : [],
+        ...rule.action === "masquerade" ? [] : [rule.to]
+      ])
+    ];
+    return [...new Set(addresses)];
+  }
   families(match) {
     const sets = this.device.firewall?.address_sets ?? {};
     const address = match?.src ?? match?.dst;
@@ -11006,6 +11252,32 @@ class Validator {
     Validator.checkFirewall(device, names, cidr);
     Validator.checkServices(device, names, report, cidr);
     Validator.checkCertificates(device, names, report);
+    Validator.checkVdoms(device, names, report, cidr, ip);
+  }
+  static checkVdoms(device, names, report, cidr, ip) {
+    const management = device.vdoms?.management;
+    if (!management)
+      return;
+    if (device.platform !== "fortios")
+      report("vdoms are a FortiOS setting");
+    if (management.name === "root")
+      report("vdoms.management.name is root, the VDOM everything else is in; give it a name of its own");
+    for (const name of management.interfaces) {
+      names.expectInterface("vdoms.management interface", name);
+      const port = device.ports?.[name];
+      if (port?.lag)
+        report(`vdoms.management interface ${name} is in LAG ${port.lag}; list the LAG`);
+    }
+    for (const route of management.static ?? []) {
+      const where = `vdoms.management static route ${route.prefix}`;
+      cidr(where, route.prefix);
+      if (route.via)
+        ip(where, route.via);
+      if (!route.via && !route.interface && !route.blackhole)
+        report(`${where} has no next hop`);
+      if (route.interface && !management.interfaces.includes(route.interface))
+        report(`${where} leaves through ${route.interface}, which is not in the VDOM`);
+    }
   }
   static checkLimits(device) {
     const limits = Catalog.limits(device.platform, device.model);

package/dist/types/core/validator.d.ts

@@ -2,6 +2,8 @@ import type { Finding, Network } from "./define.js";
 export declare class Validator {
     static run(network: Network): Finding[];
     private static checkDevice;
+    /** A management VDOM: FortiOS only, not `root`, with declared interfaces, and routes that leave through its own. */
+    private static checkVdoms;
     /** What the model's hardware holds, from the catalog. A LAG with too many members is an error; too many switch rules is a warning, since the limit is only roughly known. */
     private static checkLimits;
     private static checkVlans;

package/dist/types/helpers/upstreams.d.ts

@@ -195,9 +195,9 @@ type Names<C, N, F extends Field, Ks extends Key<C>> = {
     [K in Ks]: Named<C, N, F, K>;
 }[Ks];
 /** The catalog as written, with any key the shape does not have refused, at every level. */
-type Exact<S, T> = T extends readonly unknown[] | string | number | boolean | Secret | ((...args: never[]) => unknown) ? T : {
+type Exact<S, T> = T extends readonly unknown[] | string | number | boolean | Secret | ((...args: never[]) => unknown) ? T : S extends unknown ? {
     [K in keyof T]: K extends keyof S ? Exact<NonNullable<S[K]>, T[K]> : never;
-};
+} : never;
 /** The names as written, with a name or a role Upstreams does not make refused. */
 type ExactNames<N> = {
     [F in keyof N]: F extends keyof UpstreamNames ? N[F] extends string | ((...args: never[]) => unknown) ? N[F] : {

package/dist/types/platforms/derive.d.ts

@@ -1,6 +1,6 @@
 import type { Device } from "../schema/index.js";
 /** A feature a platform renders once proved on one of its devices. */
-export type ProvedFeature = "bfd-timers" | "static-route-bfd" | "multihop-bfd" | "alarm-severity" | "mac-limit" | "ethertype-filter";
+export type ProvedFeature = "bfd-timers" | "static-route-bfd" | "multihop-bfd" | "alarm-severity" | "mac-limit" | "ethertype-filter" | "management-vdom";
 export declare class Derive {
     /** Each LAG's number: its own `id`, or its position among the device's LAGs. */
     static lagIds(device: Device): Map<string, number>;

package/dist/types/platforms/fortios/firewall.d.ts

@@ -20,6 +20,8 @@ export declare class FortiOsFirewall {
     };
     /** A rule the platform keeps without being told: replies to a session it let through, and packets that belong to one, pass on their own. */
     static isImplied(rule: FilterRule<string, string>): boolean;
+    /** Who reaches the device's own services, alone: for a management VDOM, which routes no traffic of its own. */
+    static managementOnly(root: FortiOsBlock, device: Device): void;
     /** Packet filtering, who reaches the device, NAT and stateless ACLs. */
     static render(root: FortiOsBlock, device: Device): void;
     /**

package/dist/types/platforms/fortios/index.d.ts

@@ -92,12 +92,18 @@ export declare class FortiOs extends Platform {
     private static consoleSession;
     /** Log in, open the CLI, and run `work` in it: through the console when asked, else over SSH. */
     private static withCli;
-    /** Refuse a device on a release this adapter was not proved on, before anything is read or sent. */
+    /** Refuse a device on a release this adapter was not proved on, before anything is read or sent. Gives what `get system status` printed. */
     private static checkVersion;
+    /** Run `work` among the device's own settings: inside `config global` on a device with VDOMs, as it is on one without. */
+    private static inGlobal;
     /** Secrets the device prints: a password or an SNMPv3 key as a cipher, a certificate's key encrypted, and the SNMP community in clear. None leave the read. */
     private static scrub;
     /** Every section Circuit manages, as the device holds it, credentials scrubbed. */
     private static readConfig;
+    /**
+     * A device in multi-VDOM mode, read where each section lives: the device's own under `config global`, the rest in `root`, and a management VDOM's sections named as the render names them. A VDOM that does not exist yet is not entered, since `edit` would make it.
+     */
+    private static readVdoms;
     /** Leave every `config` and `edit` level, back to the top prompt. */
     private static leave;
     /** Send the lines that set how the device saves changes. */

package/dist/types/platforms/fortios/render.d.ts

@@ -42,6 +42,8 @@ export declare class FortiOsRender {
     private static allowAccess;
     /** The whole configuration the device should run, in the form `show` prints. */
     static of(device: Device): string;
+    /** A management VDOM's routes, and who reaches the device's own services through it, as sections of their own after everything else. */
+    private static managementVdom;
     /** A certificate with its key is the device's own; one without is only trusted. */
     private static certificates;
     private static global;

package/dist/types/platforms/fortios/vdoms.d.ts

@@ -0,0 +1,50 @@
+import type { Device } from "../../schema/index.js";
+import type { Plan } from "../platform.js";
+import { FortiOsBlock } from "./tree.js";
+/** Where a section lives in multi-VDOM mode: the device's own, or one VDOM's. */
+type Scope = {
+    kind: "global";
+} | {
+    kind: "vdom";
+    vdom: string;
+};
+export declare class FortiOsVdoms {
+    /** The VDOM everything is in unless named otherwise. */
+    static readonly ROOT = "root";
+    /**
+     * Sections under `config global` in multi-VDOM mode, from FortiOS 6.2's CLI reference: the device's identity, logins, interfaces, name resolution, time, SNMP, logging targets, flow export and session helpers. Every other section belongs to a VDOM. Not proved on a device yet.
+     */
+    static readonly GLOBAL: Set<string>;
+    /** What a management VDOM holds: its routes, and who reaches the device's own services through it, with the objects those name. */
+    static readonly MANAGEMENT_SECTIONS: readonly ["firewall address", "firewall address6", "firewall addrgrp", "firewall addrgrp6", "firewall service custom", "router static", "router static6", "firewall local-in-policy", "firewall local-in-policy6"];
+    /** The management VDOM's name, when the device has one. */
+    static managementOf(device: Device): string | undefined;
+    /** The VDOM a port or interface is in, by Circuit's name. A port in a LAG is where its LAG is. */
+    static vdomOf(device: Device, name: string): string;
+    /** A management VDOM's section as the render and the read write it. */
+    static key(vdom: string, section: string): string;
+    /** A section's scope, and its name as the device writes it. */
+    static scopeOf(key: string): {
+        scope: Scope;
+        section: string;
+    };
+    /** Whether a configuration runs in multi-VDOM mode. */
+    static isMulti(tree: FortiOsBlock): boolean;
+    /** Lines sent in a scope: inside `config global`, or inside one VDOM. */
+    static wrap(scope: Scope, lines: readonly string[]): string[];
+    /** What `show` printed in a management VDOM, each top-level section named as the render names it. */
+    static named(vdom: string, text: string): string;
+    /** The VDOMs `diagnose sys vd list` names, such as `name=mgmt/mgmt index=1`. */
+    static listed(text: string): string[];
+    /**
+     * A plan for a device that may run in multi-VDOM mode. In one VDOM it is `planOne` as it is. In several, each scope is planned on its own and its steps sent in that scope: the global steps first, then each VDOM's, then the global removals, so an interface is gone only once no VDOM names it.
+     *
+     * Turning multi-VDOM mode on or off, and moving an interface into another VDOM, are left to an operator: the first moves everything into `root` and ends every session, and the second can cut the way in. A plan that needs either holds only the problem.
+     */
+    static plan(desired: string, current: string, planOne: (desired: string, current: string) => Plan): Plan;
+    /** Interfaces the config puts in another VDOM than the device has them in. */
+    private static moved;
+    /** What a management VDOM can't hold yet, or a config with one can't have. */
+    static gaps(device: Device): string[];
+}
+export {};

package/dist/types/platforms/routeros/render.d.ts

@@ -164,8 +164,14 @@ export declare class RouterOsRender {
      */
     private addressLists;
     private firewall;
-    /** Untracked prefixes skip connection tracking in the raw table, both ways, before a connection is ever made. */
+    /**
+     * Untracked prefixes skip connection tracking in the raw table, both ways, before a connection is ever made.
+     *
+     * An address NAT uses inside one stays tracked, by an `accept` in each direction before every `notrack`: a reply to it that skipped tracking would never be translated back.
+     */
     private untracked;
+    /** Every address NAT translates to or from: each translation's target, and the address a destination translation matches. Once each, in rule order. */
+    static natAddresses(device: Device): string[];
     /**
      * The families a rule applies to. An address in the rule decides it; otherwise it applies to both.
      *