@takodotid/circuit 0.39.0 → 0.41.0

package/src/platforms/fortios/index.ts

@@ -18,6 +18,7 @@ import { FortiOsPlan } from "./plan";
 import { FortiOsRender } from "./render";
 import { FortiOsRouting } from "./routing";
 import { FortiOsBlock, FortiOsTree } from "./tree";
+import { FortiOsVdoms } from "./vdoms";
 
 /** What a session reads and writes: an SSH shell, or anything else that streams the CLI. */
 export type Channel = {
@@ -194,6 +195,7 @@ export class FortiOs extends Platform {
 
         if (device.stp) found.push("stp, ports are routed");
         found.push(...FortiOs.transparentGaps(device));
+        found.push(...FortiOsVdoms.gaps(device));
 
         for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
             if (iface.type === "vlan" && iface.mac) found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
@@ -224,7 +226,8 @@ export class FortiOs extends Platform {
             device,
             async (cli) => {
                 await FortiOs.checkVersion(cli, device);
-                return FortiOs.neighborsOf(await cli.run("diagnose lldprx neighbor details"), device);
+                const details = await FortiOs.inGlobal(cli, device, () => cli.run("diagnose lldprx neighbor details"));
+                return FortiOs.neighborsOf(details, device);
             },
             options
         );
@@ -259,7 +262,7 @@ export class FortiOs extends Platform {
     }
 
     plan(desired: string, current: string, options: ApplyOptions): Plan {
-        return FortiOsPlan.of(desired, current, options);
+        return FortiOsVdoms.plan(desired, current, (want, have) => FortiOsPlan.of(want, have, options));
     }
 
     async apply(device: Device, network: readonly Device[], changes: Plan, options: ApplyOptions): Promise<void> {
@@ -269,7 +272,7 @@ export class FortiOs extends Platform {
         const switched = changes.steps.some((step) => step.send.some((line) => line.startsWith("set opmode ")));
         if (!switched) return;
 
-        const again = FortiOsPlan.of(FortiOsRender.of(device), await this.read(device, network, options), options);
+        const again = this.plan(FortiOsRender.of(device), await this.read(device, network, options), options);
         if (!again.steps.length) return;
 
         console.log("  the operation mode changed; applying what it added on its own");
@@ -281,7 +284,8 @@ export class FortiOs extends Platform {
         await FortiOs.withCli(device, async (cli) => {
             await FortiOs.checkVersion(cli, device);
 
-            for (const line of FortiOs.fillLines(set, family, prefixes)) {
+            const lines = FortiOs.fillLines(set, family, prefixes);
+            for (const line of device.vdoms ? FortiOsVdoms.wrap({ kind: "vdom", vdom: FortiOsVdoms.ROOT }, lines) : lines) {
                 let answer = await cli.run(line);
                 if (FortiOsCli.QUESTION.test(cli.prompt) && line === "purge") answer = await cli.answer("y");
                 if (FortiOs.REFUSED.test(answer)) throw new Error(`${set}: ${line}\n    device said: ${answer.trim().slice(0, 300)}`);
@@ -433,8 +437,8 @@ export class FortiOs extends Platform {
         }
     }
 
-    /** Refuse a device on a release this adapter was not proved on, before anything is read or sent. */
-    private static async checkVersion(cli: FortiOsCli, device: Device): Promise<void> {
+    /** Refuse a device on a release this adapter was not proved on, before anything is read or sent. Gives what `get system status` printed. */
+    private static async checkVersion(cli: FortiOsCli, device: Device): Promise<string> {
         const status = await cli.run("get system status");
         const version = /^Version: \S+ v(\d+)\.(\d+)\.(\d+)/m.exec(status);
 
@@ -444,6 +448,21 @@ export class FortiOs extends Platform {
                 `${device.name} runs FortiOS ${version[1]}.${version[2]}.${version[3]}; this adapter renders for FortiOS ${FortiOs.SUPPORTED}`
             );
         }
+
+        return status;
+    }
+
+    /** Run `work` among the device's own settings: inside `config global` on a device with VDOMs, as it is on one without. */
+    private static async inGlobal<T>(cli: FortiOsCli, device: Device | boolean, work: () => Promise<T>): Promise<T> {
+        const multi = typeof device === "boolean" ? device : Boolean(device.vdoms);
+        if (!multi) return work();
+
+        await cli.run("config global");
+        try {
+            return await work();
+        } finally {
+            await FortiOs.leave(cli);
+        }
     }
 
     /** Secrets the device prints: a password or an SNMPv3 key as a cipher, a certificate's key encrypted, and the SNMP community in clear. None leave the read. */
@@ -470,13 +489,15 @@ export class FortiOs extends Platform {
 
     /** Every section Circuit manages, as the device holds it, credentials scrubbed. */
     private static async readConfig(cli: FortiOsCli, device: Device): Promise<string> {
-        await FortiOs.checkVersion(cli, device);
-
+        const status = await FortiOs.checkVersion(cli, device);
+        const show = (section: string) =>
+            cli.run(`${FortiOsRender.FULL.includes(section) ? "show full-configuration" : "show"} ${section}`, 120_000);
         const parts: string[] = [];
 
-        for (const section of FortiOsRender.SECTIONS) {
-            const show = FortiOsRender.FULL.includes(section) ? "show full-configuration" : "show";
-            parts.push(await cli.run(`${show} ${section}`, 120_000));
+        if (/^Virtual domain configuration: (multiple|split-task)/m.test(status)) {
+            parts.push(...(await FortiOs.readVdoms(cli, device, show)));
+        } else {
+            for (const section of FortiOsRender.SECTIONS) parts.push(await show(section));
         }
 
         const text = parts.join("\n");
@@ -485,16 +506,51 @@ export class FortiOs extends Platform {
         return FortiOs.scrub(FortiOsPlan.clean(text));
     }
 
+    /**
+     * A device in multi-VDOM mode, read where each section lives: the device's own under `config global`, the rest in `root`, and a management VDOM's sections named as the render names them. A VDOM that does not exist yet is not entered, since `edit` would make it.
+     */
+    private static async readVdoms(cli: FortiOsCli, device: Device, show: (section: string) => Promise<string>): Promise<string[]> {
+        const management = FortiOsVdoms.managementOf(device);
+        if (!management) throw new Error(`${device.name} runs several VDOMs and its config has no vdoms; write vdoms.management`);
+
+        const parts: string[] = [];
+        const inVdom = async (vdom: string, sections: readonly string[]) => {
+            await cli.run("config vdom");
+            await cli.run(`edit ${vdom}`);
+            try {
+                for (const section of sections) {
+                    const text = await show(section);
+                    parts.push(vdom === FortiOsVdoms.ROOT ? text : FortiOsVdoms.named(vdom, text));
+                }
+            } finally {
+                await FortiOs.leave(cli);
+            }
+        };
+
+        const listed = await FortiOs.inGlobal(cli, true, async () => {
+            for (const section of FortiOsRender.SECTIONS.filter((one) => FortiOsVdoms.GLOBAL.has(one))) parts.push(await show(section));
+            return FortiOsVdoms.listed(await cli.run("diagnose sys vd list"));
+        });
+
+        await inVdom(
+            FortiOsVdoms.ROOT,
+            FortiOsRender.SECTIONS.filter((one) => !FortiOsVdoms.GLOBAL.has(one))
+        );
+        if (listed.includes(management)) await inVdom(management, FortiOsVdoms.MANAGEMENT_SECTIONS);
+
+        return parts;
+    }
+
     /** Leave every `config` and `edit` level, back to the top prompt. */
     private static async leave(cli: FortiOsCli): Promise<void> {
         for (let level = 0; level < 10 && /\(.*\) [#$] $/.test(cli.prompt); level++) await cli.run("end");
     }
 
     /** Send the lines that set how the device saves changes. */
-    private static async saving(cli: FortiOsCli, mode: "revert" | "automatic", seconds?: number): Promise<void> {
+    private static async saving(cli: FortiOsCli, mode: "revert" | "automatic", multi: boolean, seconds?: number): Promise<void> {
         const lines = ["config system global", `set cfg-save ${mode}`, ...(seconds ? [`set cfg-revert-timeout ${seconds}`] : []), "end"];
 
-        for (const line of lines) {
+        for (const line of multi ? FortiOsVdoms.wrap({ kind: "global" }, lines) : lines) {
             const answer = await cli.run(line);
             if (FortiOs.REFUSED.test(answer)) throw new Error(`the device refused ${line}: ${answer.trim().slice(0, 300)}`);
         }
@@ -503,14 +559,14 @@ export class FortiOs extends Platform {
     /**
      * Send a plan line by line, each applied as it arrives. The device is first set to revert what is not saved, so a refused line or a fresh login that fails reloads its saved configuration. Once access is proved the change is saved, and changes save themselves again.
      */
-    private static async configure(cli: FortiOsCli, plan: Plan, guard: Guard): Promise<void> {
+    private static async configure(cli: FortiOsCli, plan: Plan, guard: Guard, multi: boolean): Promise<void> {
         const minutes = guard.seconds / 60;
-        await FortiOs.saving(cli, "revert", guard.seconds);
+        await FortiOs.saving(cli, "revert", multi, guard.seconds);
 
         // The session still open reloads the saved configuration at once; if it cannot, the device does when the time runs out.
         const restore = async (reason: string) => {
             await FortiOs.leave(cli).catch(() => undefined);
-            await cli.run("execute cfg reload").catch(() => undefined);
+            await FortiOs.inGlobal(cli, multi, () => cli.run("execute cfg reload")).catch(() => undefined);
             return new Reloaded(
                 `${reason}\n    the device reloads its saved configuration, which undoes what was sent, at the latest in ${minutes} minutes`
             );
@@ -545,14 +601,14 @@ export class FortiOs extends Platform {
             throw await restore(`a fresh login failed: ${(error as Error).message}`);
         }
 
-        const saved = await cli.run("execute cfg save", 120_000);
+        const saved = await FortiOs.inGlobal(cli, multi, () => cli.run("execute cfg save", 120_000));
         if (!/config saved|no config to be saved/.test(saved)) {
             throw new Error(
                 `access was proved but the save failed; the device reverts in ${minutes} minutes:\n    ${saved.trim().slice(0, 300)}`
             );
         }
 
-        await FortiOs.saving(cli, "automatic");
+        await FortiOs.saving(cli, "automatic", multi);
         console.log("  logged in again, saved");
     }
 
@@ -566,8 +622,9 @@ export class FortiOs extends Platform {
             const settled = await FortiOs.withCli(
                 device,
                 async (cli) => {
-                    if (!/no config to be reloaded/.test(await cli.run("execute cfg reload"))) return false;
-                    await FortiOs.saving(cli, "automatic");
+                    const reloaded = await FortiOs.inGlobal(cli, device, () => cli.run("execute cfg reload"));
+                    if (!/no config to be reloaded/.test(reloaded)) return false;
+                    await FortiOs.saving(cli, "automatic", Boolean(device.vdoms));
                     return true;
                 },
                 options
@@ -575,7 +632,7 @@ export class FortiOs extends Platform {
             if (settled) return "the device is back and saves changes on its own again";
         }
 
-        return "the device did not come back in time and still reverts every change; set `cfg-save automatic` under `config system global`";
+        return "the device did not come back in time and still reverts every change; set `cfg-save automatic` under `config system global` (in `config global` on a device with VDOMs)";
     }
 
     private static async applyOnce(device: Device, plan: Plan, options: ApplyOptions): Promise<void> {
@@ -586,7 +643,7 @@ export class FortiOs extends Platform {
             if (options.console) {
                 await FortiOs.consoleSession(device, async (cli, relogin) => {
                     await FortiOs.checkVersion(cli, device);
-                    await FortiOs.configure(cli, plan, { seconds, prove: relogin });
+                    await FortiOs.configure(cli, plan, { seconds, prove: relogin }, Boolean(device.vdoms));
                 });
                 return;
             }
@@ -594,13 +651,18 @@ export class FortiOs extends Platform {
             await FortiOs.withCli(device, async (cli) => {
                 await FortiOs.checkVersion(cli, device);
 
-                await FortiOs.configure(cli, plan, {
-                    seconds,
-                    prove: async () => {
-                        const proof = await FortiOs.login(device);
-                        proof.end();
+                await FortiOs.configure(
+                    cli,
+                    plan,
+                    {
+                        seconds,
+                        prove: async () => {
+                            const proof = await FortiOs.login(device);
+                            proof.end();
+                        },
                     },
-                });
+                    Boolean(device.vdoms)
+                );
             });
         } catch (error) {
             if (!(error instanceof Reloaded)) throw error;

package/src/platforms/fortios/render.ts

@@ -8,6 +8,7 @@ import { FortiOsFirewall } from "./firewall";
 import { FortiOsNames } from "./names";
 import { FortiOsRouting } from "./routing";
 import { FortiOsBlock, FortiOsTree } from "./tree";
+import { FortiOsVdoms } from "./vdoms";
 
 export type Section = (typeof FortiOsRender.SECTIONS)[number];
 
@@ -292,10 +293,28 @@ export class FortiOsRender {
         FortiOsRouting.render(root, device);
         FortiOsRender.helpers(section("system session-helper"), device);
         FortiOsFirewall.render(root, device);
+        FortiOsRender.managementVdom(root, device);
 
         return FortiOsTree.print(root);
     }
 
+    /** A management VDOM's routes, and who reaches the device's own services through it, as sections of their own after everything else. */
+    private static managementVdom(root: FortiOsBlock, device: Device): void {
+        const management = device.vdoms?.management;
+        if (!management) return;
+
+        const vdom = new FortiOsBlock();
+        for (const section of FortiOsVdoms.MANAGEMENT_SECTIONS) vdom.block(section);
+
+        FortiOsRender.staticRoutes(vdom.block("router static"), vdom.block("router static6"), {
+            ...device,
+            routing: { static: management.static ?? [] },
+        });
+        FortiOsFirewall.managementOnly(vdom, device);
+
+        for (const [section, block] of vdom.blocks) root.blocks.set(FortiOsVdoms.key(management.name, section), block);
+    }
+
     /** A certificate with its key is the device's own; one without is only trusted. */
     private static certificates(local: FortiOsBlock, trusted: FortiOsBlock, device: Device): void {
         for (const [name, certificate] of Object.entries(device.certificates ?? {})) {
@@ -330,6 +349,9 @@ export class FortiOsRender {
         if (device.system?.banner) block.set("pre-login-banner", "enable");
 
         if (device.lldp === true) block.set("lldp-transmission", "enable").set("lldp-reception", "enable");
+
+        const vdom = FortiOsVdoms.managementOf(device);
+        if (vdom) block.set("vdom-mode", "multi-vdom").set("management-vdom", FortiOsTree.quote(vdom));
     }
 
     /** Each user, with the profile its role takes. */
@@ -365,7 +387,7 @@ export class FortiOsRender {
             const settings = device.ports?.[port as keyof typeof device.ports];
             const entry = block.entry(Catalog.spell(device.platform, device.model, port));
 
-            entry.set("vdom", FortiOsTree.quote("root"));
+            entry.set("vdom", FortiOsTree.quote(FortiOsVdoms.vdomOf(device, port)));
             entry.set("type", "physical");
 
             if (!settings) {
@@ -395,7 +417,7 @@ export class FortiOsRender {
                 .map(([port]) => Catalog.spell(device.platform, device.model, port));
 
             const entry = block.entry(name);
-            entry.set("vdom", FortiOsTree.quote("root"));
+            entry.set("vdom", FortiOsTree.quote(FortiOsVdoms.vdomOf(device, name)));
             entry.set("type", "aggregate");
             if (members.length) entry.set("member", FortiOsTree.quoteAll(members));
             if (iface.mode === "static") entry.set("lacp-mode", "static");
@@ -410,7 +432,7 @@ export class FortiOsRender {
 
             const parent = FortiOsRender.vlanParent(device, iface.vlan);
             const entry = block.entry(name);
-            entry.set("vdom", FortiOsTree.quote("root"));
+            entry.set("vdom", FortiOsTree.quote(FortiOsVdoms.vdomOf(device, name)));
             if (parent) entry.set("interface", FortiOsTree.quote(FortiOsNames.nameOf(device, parent)));
             entry.set("vlanid", device.vlans?.[iface.vlan]?.id ?? 0);
             const domain = FortiOsNames.forwardDomainOf(device, name);
@@ -425,7 +447,7 @@ export class FortiOsRender {
             if (iface.type !== "loopback") continue;
 
             const entry = block.entry(name);
-            entry.set("vdom", FortiOsTree.quote("root"));
+            entry.set("vdom", FortiOsTree.quote(FortiOsVdoms.vdomOf(device, name)));
             entry.set("type", "loopback");
             if (iface.description) entry.set("description", FortiOsTree.quote(iface.description));
             FortiOsRender.redirects(entry, device);
@@ -454,7 +476,7 @@ export class FortiOsRender {
             }
 
             const entry = block.entry(name);
-            entry.set("vdom", FortiOsTree.quote("root"));
+            entry.set("vdom", FortiOsTree.quote(FortiOsVdoms.vdomOf(device, name)));
             entry.set("type", iface.type === "gre" ? "tunnel" : "vxlan");
             entry.set("interface", via);
             if (iface.type === "vxlan" && iface.mac) entry.set("macaddr", iface.mac.toLowerCase());

package/src/platforms/fortios/vdoms.ts

@@ -0,0 +1,217 @@
+// Virtual domains: a management VDOM beside `root`. In multi-VDOM mode some sections are the device's own, under `config global`, and the rest belong to one VDOM, under `config vdom` and `edit <name>`. The render and the read write a management VDOM's sections as `@<name> <section>`, so both sides compare like any other section; a plan is made for each scope on its own, and each of its steps sent in that scope.
+
+import type { Device } from "../../schema";
+import type { Plan, Step } from "../platform";
+import { FortiOsBlock, FortiOsTree } from "./tree";
+
+/** Where a section lives in multi-VDOM mode: the device's own, or one VDOM's. */
+type Scope = { kind: "global" } | { kind: "vdom"; vdom: string };
+
+export class FortiOsVdoms {
+    /** The VDOM everything is in unless named otherwise. */
+    static readonly ROOT = "root";
+
+    /**
+     * Sections under `config global` in multi-VDOM mode, from FortiOS 6.2's CLI reference: the device's identity, logins, interfaces, name resolution, time, SNMP, logging targets, flow export and session helpers. Every other section belongs to a VDOM. Not proved on a device yet.
+     */
+    static readonly GLOBAL = new Set([
+        "vpn certificate local",
+        "vpn certificate ca",
+        "system global",
+        'system replacemsg admin "pre_admin-disclaimer-text"',
+        "system accprofile",
+        "system admin",
+        "system interface",
+        "system dns",
+        "system ntp",
+        "system snmp sysinfo",
+        "system snmp community",
+        "system snmp user",
+        "log disk setting",
+        ...["", "2", "3", "4"].flatMap((number) => [`log syslogd${number} setting`, `log syslogd${number} filter`]),
+        "system sflow",
+        "system netflow",
+        "system session-helper",
+    ]);
+
+    /** What a management VDOM holds: its routes, and who reaches the device's own services through it, with the objects those name. */
+    static readonly MANAGEMENT_SECTIONS = [
+        "firewall address",
+        "firewall address6",
+        "firewall addrgrp",
+        "firewall addrgrp6",
+        "firewall service custom",
+        "router static",
+        "router static6",
+        "firewall local-in-policy",
+        "firewall local-in-policy6",
+    ] as const;
+
+    /** The management VDOM's name, when the device has one. */
+    static managementOf(device: Device): string | undefined {
+        return device.vdoms?.management.name;
+    }
+
+    /** The VDOM a port or interface is in, by Circuit's name. A port in a LAG is where its LAG is. */
+    static vdomOf(device: Device, name: string): string {
+        const management = device.vdoms?.management;
+        if (!management) return FortiOsVdoms.ROOT;
+
+        const lag = device.ports?.[name as keyof typeof device.ports]?.lag;
+        const holder = lag ?? name;
+        return (management.interfaces as readonly string[]).includes(holder) ? management.name : FortiOsVdoms.ROOT;
+    }
+
+    /** A management VDOM's section as the render and the read write it. */
+    static key(vdom: string, section: string): string {
+        return `@${vdom} ${section}`;
+    }
+
+    /** A section's scope, and its name as the device writes it. */
+    static scopeOf(key: string): { scope: Scope; section: string } {
+        const named = /^@(\S+) (.+)$/.exec(key);
+        if (named) return { scope: { kind: "vdom", vdom: named[1]! }, section: named[2]! };
+
+        return FortiOsVdoms.GLOBAL.has(key)
+            ? { scope: { kind: "global" }, section: key }
+            : { scope: { kind: "vdom", vdom: FortiOsVdoms.ROOT }, section: key };
+    }
+
+    /** Whether a configuration runs in multi-VDOM mode. */
+    static isMulti(tree: FortiOsBlock): boolean {
+        return tree.blocks.get("system global")?.settings.get("vdom-mode") === "multi-vdom";
+    }
+
+    /** Lines sent in a scope: inside `config global`, or inside one VDOM. */
+    static wrap(scope: Scope, lines: readonly string[]): string[] {
+        return scope.kind === "global"
+            ? ["config global", ...lines, "end"]
+            : ["config vdom", `edit ${scope.vdom}`, ...lines, "next", "end"];
+    }
+
+    /** What `show` printed in a management VDOM, each top-level section named as the render names it. */
+    static named(vdom: string, text: string): string {
+        return text.replace(/^config /gm, `config @${vdom} `);
+    }
+
+    /** The VDOMs `diagnose sys vd list` names, such as `name=mgmt/mgmt index=1`. */
+    static listed(text: string): string[] {
+        return [...text.matchAll(/^name=([^/\s]+)\//gm)].map((match) => match[1]!);
+    }
+
+    /**
+     * A plan for a device that may run in multi-VDOM mode. In one VDOM it is `planOne` as it is. In several, each scope is planned on its own and its steps sent in that scope: the global steps first, then each VDOM's, then the global removals, so an interface is gone only once no VDOM names it.
+     *
+     * Turning multi-VDOM mode on or off, and moving an interface into another VDOM, are left to an operator: the first moves everything into `root` and ends every session, and the second can cut the way in. A plan that needs either holds only the problem.
+     */
+    static plan(desired: string, current: string, planOne: (desired: string, current: string) => Plan): Plan {
+        const want = FortiOsTree.parse(desired);
+        const have = FortiOsTree.parse(current);
+        const wantMulti = FortiOsVdoms.isMulti(want);
+        const haveMulti = FortiOsVdoms.isMulti(have);
+
+        const refused = (problem: string): Plan => ({ steps: [], problems: [problem] });
+
+        if (wantMulti && !haveMulti) {
+            return refused(
+                "the config has vdoms and the device runs one VDOM. Turn multi-VDOM mode on by hand, on the console: `config system global`, `set vdom-mode multi-vdom`, `end`. It moves everything into root and ends every session"
+            );
+        }
+        if (!wantMulti && haveMulti) {
+            return refused(
+                "the device runs several VDOMs and the config has no vdoms. Write vdoms.management, or turn multi-VDOM mode off by hand"
+            );
+        }
+        if (!wantMulti) return planOne(desired, current);
+
+        const moved = FortiOsVdoms.moved(want, have);
+        if (moved.length) {
+            return refused(
+                `${moved.map(({ name, from, to }) => `${name} from ${from} to ${to}`).join(", ")}: move an interface into another VDOM by hand, on the console, since it may carry the way in`
+            );
+        }
+
+        const scopes = new Map<string, { scope: Scope; want: FortiOsBlock; have: FortiOsBlock }>();
+        const scopeFor = (scope: Scope) => {
+            const name = scope.kind === "global" ? "" : scope.vdom;
+            if (!scopes.has(name)) scopes.set(name, { scope, want: new FortiOsBlock(), have: new FortiOsBlock() });
+            return scopes.get(name)!;
+        };
+
+        for (const [side, tree] of [
+            ["want", want],
+            ["have", have],
+        ] as const) {
+            for (const [key, block] of tree.blocks) {
+                const { scope, section } = FortiOsVdoms.scopeOf(key);
+                scopeFor(scope)[side].blocks.set(section, block);
+            }
+        }
+
+        const global = scopes.get("");
+        const globalPlan: Plan = global
+            ? planOne(FortiOsTree.print(global.want), FortiOsTree.print(global.have))
+            : { steps: [], problems: [] };
+        const inScope = (scope: Scope, step: Step): Step => ({ ...step, send: FortiOsVdoms.wrap(scope, step.send) });
+        const removal = (step: Step) => step.title.endsWith(", removed");
+
+        const vdomPlans = [...scopes.values()]
+            .filter(({ scope }) => scope.kind === "vdom")
+            .map(({ scope, want: wanted, have: had }) => ({ scope, plan: planOne(FortiOsTree.print(wanted), FortiOsTree.print(had)) }));
+        const vdomSteps = vdomPlans.flatMap(({ scope, plan }) =>
+            plan.steps.map((step) => inScope(scope, { ...step, title: `${scope.kind === "vdom" ? scope.vdom : ""}: ${step.title}` }))
+        );
+
+        return {
+            problems: [...globalPlan.problems, ...vdomPlans.flatMap(({ plan }) => plan.problems)],
+            steps: [
+                ...globalPlan.steps.filter((step) => !removal(step)).map((step) => inScope({ kind: "global" }, step)),
+                ...vdomSteps,
+                ...globalPlan.steps.filter(removal).map((step) => inScope({ kind: "global" }, step)),
+            ],
+        };
+    }
+
+    /** Interfaces the config puts in another VDOM than the device has them in. */
+    private static moved(want: FortiOsBlock, have: FortiOsBlock): { name: string; from: string; to: string }[] {
+        const wanted = want.blocks.get("system interface");
+        const had = have.blocks.get("system interface");
+        if (!wanted || !had) return [];
+
+        return [...wanted.entries.entries()].flatMap(([name, { block }]) => {
+            const from = had.entries.get(name)?.block.settings.get("vdom");
+            const to = block.settings.get("vdom");
+            return from && to && FortiOsTree.bare(from) !== FortiOsTree.bare(to)
+                ? [{ name, from: FortiOsTree.bare(from), to: FortiOsTree.bare(to) }]
+                : [];
+        });
+    }
+
+    /** What a management VDOM can't hold yet, or a config with one can't have. */
+    static gaps(device: Device): string[] {
+        if (!device.vdoms) return [];
+
+        const found: string[] = [];
+        const tunnels = Object.entries(device.interfaces ?? {}).filter(([, iface]) => iface.type === "gre" || iface.type === "vxlan");
+        if (tunnels.length)
+            found.push(`vdoms with GRE or VXLAN tunnels (${tunnels.map(([name]) => name).join(", ")}), whose tables belong to a VDOM`);
+        if (Object.values(device.interfaces ?? {}).some((iface) => iface.type === "bridge"))
+            found.push("vdoms with a bridge, which needs transparent mode");
+
+        const management = device.vdoms.management;
+        const inManagement = (name: string | undefined) =>
+            name !== undefined && (management.interfaces as readonly string[]).includes(name);
+
+        for (const route of device.routing?.static ?? []) {
+            if (inManagement(route.interface))
+                found.push(`routing.static ${route.prefix} leaves through ${route.interface}, in vdoms.management; write it there`);
+        }
+        for (const name of management.interfaces) {
+            const settings =
+                device.interfaces?.[name as keyof typeof device.interfaces] ?? device.ports?.[name as keyof typeof device.ports];
+            if (settings && "vrf" in settings && settings.vrf) found.push(`vdoms.management interface ${name} in VRF ${settings.vrf}`);
+        }
+
+        return found;
+    }
+}

package/src/platforms/routeros/TRAPS.md

@@ -25,6 +25,7 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - A switch-chip rule takes one port or a range, `1900-1901`; a list is refused. The render makes one rule for each port in a list.
 - Any rule using fasttrack adds a dynamic "special dummy rule to show fasttrack counters" to the filter and the raw table. It cannot be removed, `cannot remove builtin`, so every selector over those menus skips dynamic entries.
 - The connection table holds 1,048,576 entries on a CCR2216 with 16 GiB, and a full table refuses every new connection through the router, not only the target's. A SYN flood of 210,000 packets a second filled it in five seconds; a UDP flood from random sources fills it about six times faster, because an unanswered UDP entry lives 30 seconds. Traffic in `untracked` prefixes never enters it.
+- A `notrack` in the raw table skips the reverse translation too, so a reply to a source NAT address inside an untracked block is never translated back (reported on a CCR2216, 7.23.5). A raw `accept` for the address in each direction, before the `notrack`, keeps it tracked; the router took both and counted packets on them.
 - With hardware offload on, routed traffic bypasses the forward chain entirely. `hardware_offload: false` on an interface is what makes the firewall apply to it, at the cost of CPU. The only proof of offload is the `H` flag on a route.
 - `/ip cloud ddns-enabled` cannot be turned off on 7.23.5.
 - `mac-server` and `mac-winbox` work at layer 2 and ignore the IP firewall; they are limited by interface list.

package/src/platforms/routeros/render.ts

@@ -874,13 +874,32 @@ export class RouterOsRender {
         this.switchAcls();
     }
 
-    /** Untracked prefixes skip connection tracking in the raw table, both ways, before a connection is ever made. */
+    /**
+     * Untracked prefixes skip connection tracking in the raw table, both ways, before a connection is ever made.
+     *
+     * An address NAT uses inside one stays tracked, by an `accept` in each direction before every `notrack`: a reply to it that skipped tracking would never be translated back.
+     */
     private untracked(family: Family): void {
         const menu = family === "ipv4" ? "/ip firewall raw" : "/ipv6 firewall raw";
+        const untracked = (this.device.firewall?.untracked ?? []).filter((prefix) => Address.family(prefix) === family);
 
-        for (const prefix of this.device.firewall?.untracked ?? []) {
-            if (Address.family(prefix) !== family) continue;
+        for (const address of RouterOsRender.natAddresses(this.device)) {
+            if (Address.family(address) !== family || !untracked.some((prefix) => Address.contains(prefix, address))) continue;
 
+            for (const [direction, property] of [
+                ["to", "dst-address"],
+                ["from", "src-address"],
+            ] as const) {
+                this.add(menu, "add", {
+                    action: "accept",
+                    chain: "prerouting",
+                    comment: `Tracked for NAT, ${direction} ${address}`,
+                    [property]: address,
+                });
+            }
+        }
+
+        for (const prefix of untracked) {
             for (const [direction, property] of [
                 ["to", "dst-address"],
                 ["from", "src-address"],
@@ -895,6 +914,20 @@ export class RouterOsRender {
         }
     }
 
+    /** Every address NAT translates to or from: each translation's target, and the address a destination translation matches. Once each, in rule order. */
+    static natAddresses(device: Device): string[] {
+        const nat = device.firewall?.nat;
+        const addresses = [
+            ...(nat?.source ?? []).flatMap((rule) => (rule.action === "masquerade" ? [] : [rule.to])),
+            ...(nat?.destination ?? []).flatMap((rule) => [
+                ...(rule.match?.dst ? [rule.match.dst] : []),
+                ...(rule.action === "masquerade" ? [] : [rule.to]),
+            ]),
+        ];
+
+        return [...new Set(addresses)];
+    }
+
     /**
      * The families a rule applies to. An address in the rule decides it; otherwise it applies to both.
      *