@takodotid/circuit 0.39.0 → 0.40.0

package/src/platforms/fortios/vdoms.ts

@@ -0,0 +1,217 @@
+// Virtual domains: a management VDOM beside `root`. In multi-VDOM mode some sections are the device's own, under `config global`, and the rest belong to one VDOM, under `config vdom` and `edit <name>`. The render and the read write a management VDOM's sections as `@<name> <section>`, so both sides compare like any other section; a plan is made for each scope on its own, and each of its steps sent in that scope.
+
+import type { Device } from "../../schema";
+import type { Plan, Step } from "../platform";
+import { FortiOsBlock, FortiOsTree } from "./tree";
+
+/** Where a section lives in multi-VDOM mode: the device's own, or one VDOM's. */
+type Scope = { kind: "global" } | { kind: "vdom"; vdom: string };
+
+export class FortiOsVdoms {
+    /** The VDOM everything is in unless named otherwise. */
+    static readonly ROOT = "root";
+
+    /**
+     * Sections under `config global` in multi-VDOM mode, from FortiOS 6.2's CLI reference: the device's identity, logins, interfaces, name resolution, time, SNMP, logging targets, flow export and session helpers. Every other section belongs to a VDOM. Not proved on a device yet.
+     */
+    static readonly GLOBAL = new Set([
+        "vpn certificate local",
+        "vpn certificate ca",
+        "system global",
+        'system replacemsg admin "pre_admin-disclaimer-text"',
+        "system accprofile",
+        "system admin",
+        "system interface",
+        "system dns",
+        "system ntp",
+        "system snmp sysinfo",
+        "system snmp community",
+        "system snmp user",
+        "log disk setting",
+        ...["", "2", "3", "4"].flatMap((number) => [`log syslogd${number} setting`, `log syslogd${number} filter`]),
+        "system sflow",
+        "system netflow",
+        "system session-helper",
+    ]);
+
+    /** What a management VDOM holds: its routes, and who reaches the device's own services through it, with the objects those name. */
+    static readonly MANAGEMENT_SECTIONS = [
+        "firewall address",
+        "firewall address6",
+        "firewall addrgrp",
+        "firewall addrgrp6",
+        "firewall service custom",
+        "router static",
+        "router static6",
+        "firewall local-in-policy",
+        "firewall local-in-policy6",
+    ] as const;
+
+    /** The management VDOM's name, when the device has one. */
+    static managementOf(device: Device): string | undefined {
+        return device.vdoms?.management.name;
+    }
+
+    /** The VDOM a port or interface is in, by Circuit's name. A port in a LAG is where its LAG is. */
+    static vdomOf(device: Device, name: string): string {
+        const management = device.vdoms?.management;
+        if (!management) return FortiOsVdoms.ROOT;
+
+        const lag = device.ports?.[name as keyof typeof device.ports]?.lag;
+        const holder = lag ?? name;
+        return (management.interfaces as readonly string[]).includes(holder) ? management.name : FortiOsVdoms.ROOT;
+    }
+
+    /** A management VDOM's section as the render and the read write it. */
+    static key(vdom: string, section: string): string {
+        return `@${vdom} ${section}`;
+    }
+
+    /** A section's scope, and its name as the device writes it. */
+    static scopeOf(key: string): { scope: Scope; section: string } {
+        const named = /^@(\S+) (.+)$/.exec(key);
+        if (named) return { scope: { kind: "vdom", vdom: named[1]! }, section: named[2]! };
+
+        return FortiOsVdoms.GLOBAL.has(key)
+            ? { scope: { kind: "global" }, section: key }
+            : { scope: { kind: "vdom", vdom: FortiOsVdoms.ROOT }, section: key };
+    }
+
+    /** Whether a configuration runs in multi-VDOM mode. */
+    static isMulti(tree: FortiOsBlock): boolean {
+        return tree.blocks.get("system global")?.settings.get("vdom-mode") === "multi-vdom";
+    }
+
+    /** Lines sent in a scope: inside `config global`, or inside one VDOM. */
+    static wrap(scope: Scope, lines: readonly string[]): string[] {
+        return scope.kind === "global"
+            ? ["config global", ...lines, "end"]
+            : ["config vdom", `edit ${scope.vdom}`, ...lines, "next", "end"];
+    }
+
+    /** What `show` printed in a management VDOM, each top-level section named as the render names it. */
+    static named(vdom: string, text: string): string {
+        return text.replace(/^config /gm, `config @${vdom} `);
+    }
+
+    /** The VDOMs `diagnose sys vd list` names, such as `name=mgmt/mgmt index=1`. */
+    static listed(text: string): string[] {
+        return [...text.matchAll(/^name=([^/\s]+)\//gm)].map((match) => match[1]!);
+    }
+
+    /**
+     * A plan for a device that may run in multi-VDOM mode. In one VDOM it is `planOne` as it is. In several, each scope is planned on its own and its steps sent in that scope: the global steps first, then each VDOM's, then the global removals, so an interface is gone only once no VDOM names it.
+     *
+     * Turning multi-VDOM mode on or off, and moving an interface into another VDOM, are left to an operator: the first moves everything into `root` and ends every session, and the second can cut the way in. A plan that needs either holds only the problem.
+     */
+    static plan(desired: string, current: string, planOne: (desired: string, current: string) => Plan): Plan {
+        const want = FortiOsTree.parse(desired);
+        const have = FortiOsTree.parse(current);
+        const wantMulti = FortiOsVdoms.isMulti(want);
+        const haveMulti = FortiOsVdoms.isMulti(have);
+
+        const refused = (problem: string): Plan => ({ steps: [], problems: [problem] });
+
+        if (wantMulti && !haveMulti) {
+            return refused(
+                "the config has vdoms and the device runs one VDOM. Turn multi-VDOM mode on by hand, on the console: `config system global`, `set vdom-mode multi-vdom`, `end`. It moves everything into root and ends every session"
+            );
+        }
+        if (!wantMulti && haveMulti) {
+            return refused(
+                "the device runs several VDOMs and the config has no vdoms. Write vdoms.management, or turn multi-VDOM mode off by hand"
+            );
+        }
+        if (!wantMulti) return planOne(desired, current);
+
+        const moved = FortiOsVdoms.moved(want, have);
+        if (moved.length) {
+            return refused(
+                `${moved.map(({ name, from, to }) => `${name} from ${from} to ${to}`).join(", ")}: move an interface into another VDOM by hand, on the console, since it may carry the way in`
+            );
+        }
+
+        const scopes = new Map<string, { scope: Scope; want: FortiOsBlock; have: FortiOsBlock }>();
+        const scopeFor = (scope: Scope) => {
+            const name = scope.kind === "global" ? "" : scope.vdom;
+            if (!scopes.has(name)) scopes.set(name, { scope, want: new FortiOsBlock(), have: new FortiOsBlock() });
+            return scopes.get(name)!;
+        };
+
+        for (const [side, tree] of [
+            ["want", want],
+            ["have", have],
+        ] as const) {
+            for (const [key, block] of tree.blocks) {
+                const { scope, section } = FortiOsVdoms.scopeOf(key);
+                scopeFor(scope)[side].blocks.set(section, block);
+            }
+        }
+
+        const global = scopes.get("");
+        const globalPlan: Plan = global
+            ? planOne(FortiOsTree.print(global.want), FortiOsTree.print(global.have))
+            : { steps: [], problems: [] };
+        const inScope = (scope: Scope, step: Step): Step => ({ ...step, send: FortiOsVdoms.wrap(scope, step.send) });
+        const removal = (step: Step) => step.title.endsWith(", removed");
+
+        const vdomPlans = [...scopes.values()]
+            .filter(({ scope }) => scope.kind === "vdom")
+            .map(({ scope, want: wanted, have: had }) => ({ scope, plan: planOne(FortiOsTree.print(wanted), FortiOsTree.print(had)) }));
+        const vdomSteps = vdomPlans.flatMap(({ scope, plan }) =>
+            plan.steps.map((step) => inScope(scope, { ...step, title: `${scope.kind === "vdom" ? scope.vdom : ""}: ${step.title}` }))
+        );
+
+        return {
+            problems: [...globalPlan.problems, ...vdomPlans.flatMap(({ plan }) => plan.problems)],
+            steps: [
+                ...globalPlan.steps.filter((step) => !removal(step)).map((step) => inScope({ kind: "global" }, step)),
+                ...vdomSteps,
+                ...globalPlan.steps.filter(removal).map((step) => inScope({ kind: "global" }, step)),
+            ],
+        };
+    }
+
+    /** Interfaces the config puts in another VDOM than the device has them in. */
+    private static moved(want: FortiOsBlock, have: FortiOsBlock): { name: string; from: string; to: string }[] {
+        const wanted = want.blocks.get("system interface");
+        const had = have.blocks.get("system interface");
+        if (!wanted || !had) return [];
+
+        return [...wanted.entries.entries()].flatMap(([name, { block }]) => {
+            const from = had.entries.get(name)?.block.settings.get("vdom");
+            const to = block.settings.get("vdom");
+            return from && to && FortiOsTree.bare(from) !== FortiOsTree.bare(to)
+                ? [{ name, from: FortiOsTree.bare(from), to: FortiOsTree.bare(to) }]
+                : [];
+        });
+    }
+
+    /** What a management VDOM can't hold yet, or a config with one can't have. */
+    static gaps(device: Device): string[] {
+        if (!device.vdoms) return [];
+
+        const found: string[] = [];
+        const tunnels = Object.entries(device.interfaces ?? {}).filter(([, iface]) => iface.type === "gre" || iface.type === "vxlan");
+        if (tunnels.length)
+            found.push(`vdoms with GRE or VXLAN tunnels (${tunnels.map(([name]) => name).join(", ")}), whose tables belong to a VDOM`);
+        if (Object.values(device.interfaces ?? {}).some((iface) => iface.type === "bridge"))
+            found.push("vdoms with a bridge, which needs transparent mode");
+
+        const management = device.vdoms.management;
+        const inManagement = (name: string | undefined) =>
+            name !== undefined && (management.interfaces as readonly string[]).includes(name);
+
+        for (const route of device.routing?.static ?? []) {
+            if (inManagement(route.interface))
+                found.push(`routing.static ${route.prefix} leaves through ${route.interface}, in vdoms.management; write it there`);
+        }
+        for (const name of management.interfaces) {
+            const settings =
+                device.interfaces?.[name as keyof typeof device.interfaces] ?? device.ports?.[name as keyof typeof device.ports];
+            if (settings && "vrf" in settings && settings.vrf) found.push(`vdoms.management interface ${name} in VRF ${settings.vrf}`);
+        }
+
+        return found;
+    }
+}

package/src/platforms/routeros/TRAPS.md

@@ -25,6 +25,7 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - A switch-chip rule takes one port or a range, `1900-1901`; a list is refused. The render makes one rule for each port in a list.
 - Any rule using fasttrack adds a dynamic "special dummy rule to show fasttrack counters" to the filter and the raw table. It cannot be removed, `cannot remove builtin`, so every selector over those menus skips dynamic entries.
 - The connection table holds 1,048,576 entries on a CCR2216 with 16 GiB, and a full table refuses every new connection through the router, not only the target's. A SYN flood of 210,000 packets a second filled it in five seconds; a UDP flood from random sources fills it about six times faster, because an unanswered UDP entry lives 30 seconds. Traffic in `untracked` prefixes never enters it.
+- A `notrack` in the raw table skips the reverse translation too, so a reply to a source NAT address inside an untracked block is never translated back (reported on a CCR2216, 7.23.5). A raw `accept` for the address in each direction, before the `notrack`, keeps it tracked; the router took both and counted packets on them.
 - With hardware offload on, routed traffic bypasses the forward chain entirely. `hardware_offload: false` on an interface is what makes the firewall apply to it, at the cost of CPU. The only proof of offload is the `H` flag on a route.
 - `/ip cloud ddns-enabled` cannot be turned off on 7.23.5.
 - `mac-server` and `mac-winbox` work at layer 2 and ignore the IP firewall; they are limited by interface list.

package/src/platforms/routeros/render.ts

@@ -874,13 +874,32 @@ export class RouterOsRender {
         this.switchAcls();
     }
 
-    /** Untracked prefixes skip connection tracking in the raw table, both ways, before a connection is ever made. */
+    /**
+     * Untracked prefixes skip connection tracking in the raw table, both ways, before a connection is ever made.
+     *
+     * An address NAT uses inside one stays tracked, by an `accept` in each direction before every `notrack`: a reply to it that skipped tracking would never be translated back.
+     */
     private untracked(family: Family): void {
         const menu = family === "ipv4" ? "/ip firewall raw" : "/ipv6 firewall raw";
+        const untracked = (this.device.firewall?.untracked ?? []).filter((prefix) => Address.family(prefix) === family);
 
-        for (const prefix of this.device.firewall?.untracked ?? []) {
-            if (Address.family(prefix) !== family) continue;
+        for (const address of RouterOsRender.natAddresses(this.device)) {
+            if (Address.family(address) !== family || !untracked.some((prefix) => Address.contains(prefix, address))) continue;
 
+            for (const [direction, property] of [
+                ["to", "dst-address"],
+                ["from", "src-address"],
+            ] as const) {
+                this.add(menu, "add", {
+                    action: "accept",
+                    chain: "prerouting",
+                    comment: `Tracked for NAT, ${direction} ${address}`,
+                    [property]: address,
+                });
+            }
+        }
+
+        for (const prefix of untracked) {
             for (const [direction, property] of [
                 ["to", "dst-address"],
                 ["from", "src-address"],
@@ -895,6 +914,20 @@ export class RouterOsRender {
         }
     }
 
+    /** Every address NAT translates to or from: each translation's target, and the address a destination translation matches. Once each, in rule order. */
+    static natAddresses(device: Device): string[] {
+        const nat = device.firewall?.nat;
+        const addresses = [
+            ...(nat?.source ?? []).flatMap((rule) => (rule.action === "masquerade" ? [] : [rule.to])),
+            ...(nat?.destination ?? []).flatMap((rule) => [
+                ...(rule.match?.dst ? [rule.match.dst] : []),
+                ...(rule.action === "masquerade" ? [] : [rule.to]),
+            ]),
+        ];
+
+        return [...new Set(addresses)];
+    }
+
     /**
      * The families a rule applies to. An address in the rule decides it; otherwise it applies to both.
      *

package/src/schema/device.ts

@@ -2,7 +2,7 @@ import type { IP, Secret } from "./common";
 import type { AclRule, Firewall } from "./firewall";
 import type { Interface, Port, Vlan } from "./interfaces";
 import type { PrefixSet, RoutePolicy } from "./policy";
-import type { Routing } from "./routing";
+import type { Routing, StaticRoute } from "./routing";
 import type { Certificate, DhcpRelay, DhcpServer, FlowExport, Management, System, User } from "./system";
 
 /** How the framework reaches the device. */
@@ -43,6 +43,25 @@ export type Console = {
     passwordOnly?: true;
 };
 
+/**
+ * Virtual domains, on FortiOS: the device's own traffic kept apart from the traffic it routes. Everything is in `root` when absent.
+ *
+ * Multi-VDOM mode is turned on by hand, not by a plan: it moves the whole configuration into `root` and ends every session.
+ */
+export type Vdoms<I extends string> = {
+    /**
+     * A VDOM for the device's own traffic: FortiGuard, NTP, DNS and logging leave from it, by its own routes, so they never follow the routed traffic's default route. Everything not listed here stays in `root`.
+     */
+    management: {
+        /** Its name, such as `mgmt`. Not `root`. */
+        name: string;
+        /** The ports and interfaces in it, by name. A LAG's member ports go with the LAG. */
+        interfaces: readonly I[];
+        /** Its static routes, such as its own default route. */
+        static?: readonly StaticRoute<I, never>[];
+    };
+};
+
 /** A separate routing table, with the interfaces that route in it. */
 export type Vrf = {
     /** What the VRF is for. */
@@ -120,4 +139,6 @@ export type Device<
     };
     /** Forward in hardware where the platform can. An interface may override it. */
     hardware_offload?: boolean;
+    /** Virtual domains, on FortiOS only: a management VDOM apart from the routed traffic. */
+    vdoms?: Vdoms<NoInfer<I | N>>;
 };

package/src/schema/firewall.ts

@@ -104,7 +104,7 @@ export type Firewall<I extends string, AS extends string> = {
     };
     /** Helpers that run. None when absent. */
     helpers?: readonly Helper[];
-    /** Traffic to and from these prefixes passes without connection tracking. A flood toward them cannot fill the connection table, and rules see its packets in the state `untracked`. Everything is tracked when absent. */
+    /** Traffic to and from these prefixes passes without connection tracking. A flood toward them cannot fill the connection table, and rules see its packets in the state `untracked`. An address NAT uses inside one stays tracked, or its replies would never be translated back. Everything is tracked when absent. */
     untracked?: readonly Prefix[];
 };