@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/src/platforms/derive.ts

@@ -2,7 +2,13 @@
 
 import { Address } from "../core/address";
 import { Utils } from "../core/utils";
-import type { Device } from "../schema";
+import type { Device, Interface, InterfaceKind, Port } from "../model";
+
+/** One interface of a device, with the group it is in. */
+export type NamedInterface = { name: string; kind: InterfaceKind; settings: Interface };
+
+/** The groups of `interfaces` besides `ethernet`, in the order Circuit reads them. */
+const KINDS: readonly InterfaceKind[] = ["lag", "vlan_interface", "bridge", "loopback", "gre", "vxlan", "wireguard"];
 
 /** A feature a platform renders once proved on one of its devices. */
 export type ProvedFeature =
@@ -16,16 +22,35 @@ export type ProvedFeature =
     | "routing-tables";
 
 export class Derive {
+    /** Every interface that is not a port, group by group (`KINDS`), each in the order it is written. */
+    static interfaces(device: Device): NamedInterface[] {
+        return KINDS.flatMap((kind) =>
+            Object.entries<Interface | undefined>(device.interfaces?.[kind] ?? {}).flatMap(([name, settings]) =>
+                settings ? [{ name, kind, settings }] : []
+            )
+        );
+    }
+
+    /** Every port the device writes, in the order it is written. */
+    static ports(device: Device): [string, Port][] {
+        return Object.entries<Port | undefined>(device.interfaces?.ethernet ?? {}).flatMap(([name, port]) =>
+            port ? [[name, port] as [string, Port]] : []
+        );
+    }
+
+    /** A port or an interface by its name, whatever group it is in. */
+    static settings(device: Device, name: string): Port | Interface | undefined {
+        return device.interfaces?.ethernet?.[name] ?? Derive.interfaces(device).find((entry) => entry.name === name)?.settings;
+    }
+
     /** Each LAG's number: its own `id`, or its position among the device's LAGs. */
     static lagIds(device: Device): Map<string, number> {
         const numbers = new Map<string, number>();
         let position = 0;
 
-        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-            if (iface.type !== "lag") continue;
-
+        for (const [name, lag] of Object.entries(device.interfaces?.lag ?? {})) {
             position++;
-            numbers.set(name, iface.id ?? position);
+            numbers.set(name, lag?.id ?? position);
         }
 
         return numbers;
@@ -33,8 +58,9 @@ export class Derive {
 
     /** The IPv4 networks of a port's or an interface's addresses. */
     static ipv4Networks(device: Device, iface: string): string[] {
-        const settings = device.interfaces?.[iface] ?? device.ports?.[iface as keyof typeof device.ports];
-        const addresses = (settings?.addresses ?? []).map((entry) => (typeof entry === "string" ? entry : entry.address));
+        const addresses = (Derive.settings(device, iface)?.addresses ?? []).map((entry) =>
+            typeof entry === "string" ? entry : entry.address
+        );
 
         return addresses.filter((address) => Address.family(address) === "ipv4").map((address) => Address.prefixOf(address));
     }
@@ -50,32 +76,33 @@ export class Derive {
         const has = (feature: ProvedFeature) => proved.includes(feature);
 
         if (routing?.bfd && !has("bfd-timers")) found.push(`routing.bfd, BFD timers are ${unproved}`);
-        if (device.vdoms && !has("management-vdom")) found.push(`vdoms, a management VDOM is ${unproved}`);
+        if (device.system?.vdoms && !has("management-vdom")) found.push(`system.vdoms, a management VDOM is ${unproved}`);
 
-        for (const route of routing?.static ?? []) {
+        for (const route of routing?.static_routes ?? []) {
             if (route.bfd && !has("static-route-bfd"))
-                found.push(`routing.static ${route.prefix} bfd, BFD on a static route is ${unproved}`);
-            if (Utils.otherTable(route.table) && !has("routing-tables"))
-                found.push(`routing.static ${route.prefix} table, a routing table beside the main one is ${unproved}`);
+                found.push(`routing.static_routes ${route.prefix} bfd, BFD on a static route is ${unproved}`);
+            if (Utils.otherTable(route.routing_table) && !has("routing-tables"))
+                found.push(`routing.static_routes ${route.prefix} routing_table, a routing table beside the main one is ${unproved}`);
         }
 
         if (!has("routing-tables")) {
             if (routing?.tables) found.push(`routing.tables, a routing table beside the main one is ${unproved}`);
-            if (routing?.rules) found.push(`routing.rules, routing rules are ${unproved}`);
+            if (routing?.policy_routing) found.push(`routing.policy_routing, policy routing is ${unproved}`);
         }
 
         const bgp = routing?.bgp;
 
-        for (const [name, group] of Object.entries(bgp?.groups ?? {})) {
-            if (Utils.otherTable(group.table) && !has("routing-tables"))
-                found.push(`routing.bgp.groups.${name}.table, a routing table beside the main one is ${unproved}`);
+        for (const [name, group] of Object.entries(bgp?.neighbor_groups ?? {})) {
+            if (Utils.otherTable(group?.routing_table) && !has("routing-tables"))
+                found.push(`routing.bgp.neighbor_groups.${name}.routing_table, a routing table beside the main one is ${unproved}`);
         }
 
         for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
-            if (Utils.otherTable(neighbor.table) && !has("routing-tables"))
-                found.push(`routing.bgp.neighbors.${name}.table, a routing table beside the main one is ${unproved}`);
+            if (!neighbor) continue;
+            if (Utils.otherTable(neighbor.routing_table) && !has("routing-tables"))
+                found.push(`routing.bgp.neighbors.${name}.routing_table, a routing table beside the main one is ${unproved}`);
 
-            const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
+            const group = neighbor.neighbor_group ? bgp?.neighbor_groups?.[neighbor.neighbor_group] : undefined;
             const bfd = neighbor.bfd ?? group?.bfd;
             const multihop = neighbor.multihop ?? group?.multihop;
 
@@ -89,12 +116,9 @@ export class Derive {
             }
         }
 
-        const holders = [
-            ...Object.entries(device.ports ?? {}).map(([name, settings]) => ({ where: `ports.${name}`, settings })),
-            ...Object.entries(device.interfaces ?? {}).map(([name, settings]) => ({
-                where: `interfaces.${name}`,
-                settings: settings.type === "lag" ? settings : undefined,
-            })),
+        const holders: { where: string; settings: { mac_limit?: number; ethertypes?: readonly string[] } | undefined }[] = [
+            ...Derive.ports(device).map(([name, settings]) => ({ where: `interfaces.ethernet.${name}`, settings })),
+            ...Object.entries(device.interfaces?.lag ?? {}).map(([name, settings]) => ({ where: `interfaces.lag.${name}`, settings })),
         ];
 
         for (const { where, settings } of holders) {
@@ -115,26 +139,29 @@ export class Derive {
         const found: string[] = [];
 
         for (const service of Derive.SWITCH_SERVICES) {
-            const settings = device.management?.[service];
+            // SNMP is in `monitoring`, the other services in `management`.
+            const group = service === "snmp" ? "monitoring" : "management";
+            const settings = service === "snmp" ? device.monitoring?.snmp : device.management?.[service];
             if (settings?.allow && !ownSources.includes(service))
-                found.push(`management.${service}.allow, every service takes management.allow`);
-            if (settings?.port) found.push(`management.${service}.port`);
+                found.push(`${group}.${service}.allow, every service takes management.allow`);
+            if (settings?.port) found.push(`${group}.${service}.port`);
         }
 
-        for (const [name, user] of Object.entries(device.users ?? {})) {
-            if (user.description) found.push(`users.${name}.description`);
-            if (user.ssh_keys?.length) found.push(`users.${name}.ssh_keys`);
+        for (const [name, user] of Object.entries(device.system?.users ?? {})) {
+            if (user?.description) found.push(`system.users.${name}.description`);
+            if (user?.ssh_keys?.length) found.push(`system.users.${name}.ssh_keys`);
         }
 
-        if (device.system?.ip) found.push("system.ip");
+        if (device.system?.ip_stack) found.push("system.ip_stack");
 
-        for (const [name, port] of Object.entries(device.ports ?? {})) {
-            if (port?.hardware_offload !== undefined) found.push(`ports.${name}.hardware_offload`);
+        for (const [name, port] of Derive.ports(device)) {
+            if (port.hardware_offload !== undefined) found.push(`interfaces.ethernet.${name}.hardware_offload`);
         }
 
-        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-            if (iface.addresses?.some((entry) => typeof entry !== "string")) found.push(`interfaces.${name}.addresses with a peer`);
-            if (iface.hardware_offload !== undefined) found.push(`interfaces.${name}.hardware_offload`);
+        for (const { name, kind, settings } of Derive.interfaces(device)) {
+            if (settings.addresses?.some((entry) => typeof entry !== "string"))
+                found.push(`interfaces.${kind}.${name}.addresses with a peer`);
+            if (settings.hardware_offload !== undefined) found.push(`interfaces.${kind}.${name}.hardware_offload`);
         }
 
         return found;

package/src/platforms/finding.ts

@@ -0,0 +1,9 @@
+/** Something wrong with a config, as `circuit validate` reports it. */
+export type Finding = {
+    /** An error stops `diff` and `apply`; a warning is reported only. */
+    level: "error" | "warning";
+    /** The device it is about, when it is about one. */
+    device?: string;
+    /** What is wrong, in a sentence. */
+    message: string;
+};

package/src/platforms/fortios/firewall.ts

@@ -1,8 +1,10 @@
 // Packet filtering as policies through the device and local-in policies to it, who reaches the device's own services, NAT as central source NAT and virtual IPs, and stateless ACLs on ports.
 
 import { Address } from "../../core/address";
-import type { AclRule, Device, Family, FilterMatch, FilterRule, NatRule, Ports, Prefix, Protocol } from "../../schema";
+import type { AclRule, Device, Family, FilterMatch, FilterRule, NatRule, Ports, Prefix, Protocol, Service } from "../../model";
+import { Derive } from "../derive";
 import { FortiOsNames } from "./names";
+
 import { FortiOsBlock, FortiOsTree } from "./tree";
 
 /** The address objects, groups and services rules name, each created once. */
@@ -48,7 +50,7 @@ class Objects {
         this.root.block("firewall ippool").entry(address).set("startip", address).set("endip", address);
     }
 
-    service(match: FilterMatch<string, string> | undefined, family: Family): string {
+    service(match: FilterMatch | undefined, family: Family): string {
         const { name, block } = FortiOsFirewall.serviceOf(match, family);
 
         // Transparent mode deletes the factory's services, `ALL` with them, so every protocol is a service of Circuit's own there.
@@ -69,7 +71,7 @@ export class FortiOsFirewall {
     /** IP protocol numbers, for a protocol the platform names only by number. */
     static readonly PROTOCOL_NUMBER: Record<Protocol, number> = { tcp: 6, udp: 17, icmp: 1, gre: 47, esp: 50, ah: 51, ospf: 89, vrrp: 112 };
 
-    /** The device's own services, by the config's name, with the protocol and port each listens on unless the config moves it. */
+    /** The device's own services, by the name their guards take, with the protocol and port each listens on unless the config moves it. */
     private static readonly SERVICES = {
         ssh: { protocol: "tcp", port: 22 },
         https: { protocol: "tcp", port: 443 },
@@ -79,25 +81,34 @@ export class FortiOsFirewall {
         native: { protocol: "tcp", port: 541 },
     } as const;
 
+    /** A service's settings in the config: SNMP is in `monitoring`, the native protocol is `management.native_protocol`. */
+    private static serviceSettings(device: Device, service: keyof typeof FortiOsFirewall.SERVICES): Service | undefined {
+        if (service === "snmp") return device.monitoring?.snmp;
+        if (service === "native") return device.management?.native_protocol;
+        return device.management?.[service];
+    }
+
     /** Every protocol, as a service of Circuit's own, for a device in transparent mode. */
     static readonly ALL_IN_TRANSPARENT = "circuit-all";
 
     /** NAT rules of both directions, which central NAT needs turned on. */
-    static natRules(device: Device): NatRule<string, string>[] {
+    static natRules(device: Device): NatRule[] {
         const nat = device.firewall?.nat;
         return [...(nat?.source ?? []), ...(nat?.destination ?? [])];
     }
 
     /** Which families a rule applies to: its own, its addresses', or both. */
-    static familiesOf(device: Device, match: FilterMatch<string, string> | undefined): Family[] {
+    static familiesOf(device: Device, match: FilterMatch | undefined): Family[] {
         if (match?.family) return [match.family];
 
-        const prefixes = [match?.src, match?.dst].filter((prefix): prefix is Prefix => prefix !== undefined);
+        const prefixes = [FortiOsNames.single(match?.src), FortiOsNames.single(match?.dst)].filter(
+            (prefix): prefix is Prefix => prefix !== undefined
+        );
         if (prefixes.length) return [...new Set(prefixes.map(FortiOsNames.familyOfPrefix))];
 
         let families: Family[] = ["ipv4", "ipv6"];
 
-        for (const set of [match?.src_set, match?.dst_set]) {
+        for (const set of [match?.src_address_set, match?.dst_address_set]) {
             if (!set) continue;
 
             const present = new Set((device.firewall?.address_sets?.[set] ?? []).map(FortiOsNames.familyOfPrefix));
@@ -116,7 +127,7 @@ export class FortiOsFirewall {
     }
 
     /** The service a rule matches, by name, with what it holds. `ALL` when the rule names no protocol and no port; ports without a protocol are TCP's and UDP's. */
-    static serviceOf(match: FilterMatch<string, string> | undefined, family: Family): { name: string; block?: FortiOsBlock } {
+    static serviceOf(match: FilterMatch | undefined, family: Family): { name: string; block?: FortiOsBlock } {
         const protocol = match?.protocol;
         const destinations = FortiOsFirewall.portList(match?.dst_port);
         const sources = FortiOsFirewall.portList(match?.src_port);
@@ -145,10 +156,10 @@ export class FortiOsFirewall {
     }
 
     /** A rule the platform keeps without being told: replies to a session it let through, and packets that belong to one, pass on their own. */
-    static isImplied(rule: FilterRule<string, string>): boolean {
-        const state = rule.match?.state;
+    static isImplied(rule: FilterRule): boolean {
+        const state = rule.if?.connection_state;
         return (
-            rule.action === "accept" &&
+            rule.then === "accept" &&
             state !== undefined &&
             state.length > 0 &&
             state.every((one) => one === "established" || one === "related")
@@ -175,17 +186,17 @@ export class FortiOsFirewall {
         for (const rule of forward?.rules ?? []) {
             if (FortiOsFirewall.isImplied(rule)) continue;
 
-            for (const family of FortiOsFirewall.familiesOf(device, rule.match)) {
+            for (const family of FortiOsFirewall.familiesOf(device, rule.if)) {
                 const table = root.block(family === "ipv4" ? "firewall policy" : "firewall policy6");
                 FortiOsFirewall.policy(table.entry(++policies[family]), objects, device, rule, family);
             }
         }
 
         // A packet no rule matched is accepted unless the chain drops it; the platform's own last word is deny.
-        if (forward?.default !== "drop") {
+        if (forward?.default_action !== "drop") {
             for (const family of ["ipv4", "ipv6"] as const) {
                 const table = root.block(family === "ipv4" ? "firewall policy" : "firewall policy6");
-                FortiOsFirewall.policy(table.entry(++policies[family]), objects, device, { action: "accept" }, family);
+                FortiOsFirewall.policy(table.entry(++policies[family]), objects, device, { then: "accept" }, family);
             }
         }
 
@@ -200,14 +211,14 @@ export class FortiOsFirewall {
         for (const rule of input?.rules ?? []) {
             if (FortiOsFirewall.isImplied(rule)) continue;
 
-            for (const family of FortiOsFirewall.familiesOf(device, rule.match)) {
+            for (const family of FortiOsFirewall.familiesOf(device, rule.if)) {
                 FortiOsFirewall.localIn(localInEntry(family), objects, device, rule, family);
             }
         }
 
-        if (input?.default === "drop") {
+        if (input?.default_action === "drop") {
             for (const family of ["ipv4", "ipv6"] as const) {
-                FortiOsFirewall.localIn(localInEntry(family), objects, device, { action: "drop" }, family);
+                FortiOsFirewall.localIn(localInEntry(family), objects, device, { then: "drop" }, family);
             }
         }
 
@@ -227,13 +238,12 @@ export class FortiOsFirewall {
     private static management(entry: (family: Family) => FortiOsBlock, objects: Objects, device: Device): void {
         type Services = typeof FortiOsFirewall.SERVICES;
 
-        const config = device.management ?? {};
         const guards = new Map<string, { sources: readonly string[]; services: string[] }>();
 
         for (const [service, listener] of Object.entries(FortiOsFirewall.SERVICES) as [keyof Services, Services[keyof Services]][]) {
-            const settings = config[service];
-            const sources = settings?.allow ?? config.allow;
-            if (!settings || !sources?.length) continue;
+            const settings = FortiOsFirewall.serviceSettings(device, service);
+            const sources = settings?.allow ?? FortiOsNames.allowed(device);
+            if (!settings || !sources.length) continue;
 
             const name = settings.allow ? `circuit-${service}` : "circuit-management";
             const guard = guards.get(name) ?? { sources, services: [] };
@@ -274,52 +284,52 @@ export class FortiOsFirewall {
     }
 
     /** A policy for traffic through the device. A rejection answers the sender; the platform's deny is silent otherwise. */
-    private static policy(entry: FortiOsBlock, objects: Objects, device: Device, rule: FilterRule<string, string>, family: Family): void {
-        const match = rule.match;
-
-        entry.set("srcintf", FortiOsFirewall.interfaceOf(device, match?.in_interface));
-        entry.set("dstintf", FortiOsFirewall.interfaceOf(device, match?.out_interface));
-        entry.set("srcaddr", FortiOsTree.quote(objects.address(match?.src, match?.src_set, family)));
-        entry.set("dstaddr", FortiOsTree.quote(objects.address(match?.dst, match?.dst_set, family)));
-        entry.set("action", rule.action === "accept" ? "accept" : "deny");
+    private static policy(entry: FortiOsBlock, objects: Objects, device: Device, rule: FilterRule, family: Family): void {
+        const match = rule.if;
+
+        entry.set("srcintf", FortiOsFirewall.interfaceOf(device, FortiOsNames.single(match?.in_interface)));
+        entry.set("dstintf", FortiOsFirewall.interfaceOf(device, FortiOsNames.single(match?.out_interface)));
+        entry.set("srcaddr", FortiOsTree.quote(objects.address(FortiOsNames.single(match?.src), match?.src_address_set, family)));
+        entry.set("dstaddr", FortiOsTree.quote(objects.address(FortiOsNames.single(match?.dst), match?.dst_address_set, family)));
+        entry.set("action", rule.then === "accept" ? "accept" : "deny");
         entry.set("schedule", FortiOsTree.quote("always"));
         entry.set("service", FortiOsTree.quote(objects.service(match, family)));
 
         // The device gives a deny policy `logtraffic disable` of its own accord.
-        if (rule.action !== "accept") entry.set("logtraffic", "disable");
-        if (rule.action === "accept" && !device.hardware_offload && !rule.offload) entry.set("auto-asic-offload", "disable");
+        if (rule.then !== "accept") entry.set("logtraffic", "disable");
+        if (rule.then === "accept" && !device.system?.hardware_offload && !rule.fast_path) entry.set("auto-asic-offload", "disable");
         if (rule.description) entry.set("comments", FortiOsTree.quote(rule.description));
-        if (rule.action === "reject") entry.set("send-deny-packet", "enable");
+        if (rule.then === "reject") entry.set("send-deny-packet", "enable");
     }
 
     /** A local-in policy, for traffic to the device itself. */
-    private static localIn(entry: FortiOsBlock, objects: Objects, device: Device, rule: FilterRule<string, string>, family: Family): void {
-        const match = rule.match;
+    private static localIn(entry: FortiOsBlock, objects: Objects, device: Device, rule: FilterRule, family: Family): void {
+        const match = rule.if;
 
-        entry.set("intf", FortiOsFirewall.interfaceOf(device, match?.in_interface));
-        entry.set("srcaddr", FortiOsTree.quote(objects.address(match?.src, match?.src_set, family)));
-        entry.set("dstaddr", FortiOsTree.quote(objects.address(match?.dst, match?.dst_set, family)));
-        entry.set("action", rule.action === "accept" ? "accept" : "deny");
+        entry.set("intf", FortiOsFirewall.interfaceOf(device, FortiOsNames.single(match?.in_interface)));
+        entry.set("srcaddr", FortiOsTree.quote(objects.address(FortiOsNames.single(match?.src), match?.src_address_set, family)));
+        entry.set("dstaddr", FortiOsTree.quote(objects.address(FortiOsNames.single(match?.dst), match?.dst_address_set, family)));
+        entry.set("action", rule.then === "accept" ? "accept" : "deny");
         entry.set("service", FortiOsTree.quote(objects.service(match, family)));
         entry.set("schedule", FortiOsTree.quote("always"));
         if (rule.description) entry.set("comments", FortiOsTree.quote(rule.description));
     }
 
     /** Source NAT: to the outgoing interface's address, or to a pool of one address. */
-    private static sourceNat(entry: FortiOsBlock, objects: Objects, device: Device, rule: NatRule<string, string>): void {
-        const match = rule.match;
+    private static sourceNat(entry: FortiOsBlock, objects: Objects, device: Device, rule: NatRule): void {
+        const match = rule.if;
 
-        entry.set("orig-addr", FortiOsTree.quote(objects.address(match?.src, match?.src_set, "ipv4")));
-        entry.set("srcintf", FortiOsFirewall.interfaceOf(device, match?.in_interface));
-        entry.set("dst-addr", FortiOsTree.quote(objects.address(match?.dst, match?.dst_set, "ipv4")));
-        entry.set("dstintf", FortiOsFirewall.interfaceOf(device, match?.out_interface));
+        entry.set("orig-addr", FortiOsTree.quote(objects.address(FortiOsNames.single(match?.src), match?.src_address_set, "ipv4")));
+        entry.set("srcintf", FortiOsFirewall.interfaceOf(device, FortiOsNames.single(match?.in_interface)));
+        entry.set("dst-addr", FortiOsTree.quote(objects.address(FortiOsNames.single(match?.dst), match?.dst_address_set, "ipv4")));
+        entry.set("dstintf", FortiOsFirewall.interfaceOf(device, FortiOsNames.single(match?.out_interface)));
         if (match?.protocol) entry.set("protocol", FortiOsFirewall.PROTOCOL_NUMBER[match.protocol]);
 
         const ports = FortiOsFirewall.portList(match?.src_port);
 
-        if (rule.action === "snat") {
-            objects.pool(rule.to);
-            entry.set("nat-ippool", FortiOsTree.quote(rule.to));
+        if (rule.then === "snat") {
+            objects.pool(rule.to_address);
+            entry.set("nat-ippool", FortiOsTree.quote(rule.to_address));
             // A pool keeps the source port only when told which.
             if (ports.length) entry.set("orig-port", ports[0]!).set("nat-port", rule.to_port ?? ports[0]!);
         } else if (ports.length) {
@@ -330,20 +340,22 @@ export class FortiOsFirewall {
     }
 
     /** Destination NAT, as a virtual IP: the address it answers on, and the port it forwards when the rule names one. */
-    private static destinationNat(entry: FortiOsBlock, device: Device, rule: NatRule<string, string>): void {
-        if (rule.action !== "dnat") return;
+    private static destinationNat(entry: FortiOsBlock, device: Device, rule: NatRule): void {
+        if (rule.then !== "dnat") return;
 
-        const match = rule.match;
+        const match = rule.if;
+        const dst = FortiOsNames.single(match?.dst);
+        const src = FortiOsNames.single(match?.src);
         if (rule.description) entry.set("comment", FortiOsTree.quote(rule.description));
-        if (match?.dst) entry.set("extip", Address.host(FortiOsNames.withLength(match.dst)));
-        entry.set("extintf", FortiOsFirewall.interfaceOf(device, match?.in_interface));
+        if (dst) entry.set("extip", Address.host(FortiOsNames.withLength(dst)));
+        entry.set("extintf", FortiOsFirewall.interfaceOf(device, FortiOsNames.single(match?.in_interface)));
 
-        const sources = match?.src ? [match.src] : match?.src_set ? (device.firewall?.address_sets?.[match.src_set] ?? []) : [];
+        const sources = src ? [src] : match?.src_address_set ? (device.firewall?.address_sets?.[match.src_address_set] ?? []) : [];
         if (sources.length) entry.set("src-filter", FortiOsTree.quoteAll(sources.map(FortiOsNames.network)));
 
         const ports = FortiOsFirewall.portList(match?.dst_port);
         if (ports.length) entry.set("portforward", "enable");
-        entry.set("mappedip", FortiOsTree.quote(rule.to));
+        entry.set("mappedip", FortiOsTree.quote(rule.to_address));
 
         if (ports.length) {
             if (match?.protocol === "udp") entry.set("protocol", "udp");
@@ -358,20 +370,20 @@ export class FortiOsFirewall {
     private static acls(root: FortiOsBlock, objects: Objects, device: Device): void {
         const counters = { ipv4: 0, ipv6: 0 };
 
-        for (const [port, settings] of Object.entries(device.ports ?? {})) {
-            if (!settings?.acl) continue;
+        for (const [port, settings] of Derive.ports(device)) {
+            if (!settings.ingress_acl) continue;
 
-            for (const rule of device.acls?.[settings.acl] ?? []) {
-                if (rule.action !== "drop") continue;
+            for (const rule of device.switching?.acls?.[settings.ingress_acl] ?? []) {
+                if (rule.then !== "drop") continue;
 
-                const match = rule.match as FilterMatch<string, string> | undefined;
+                const { vlan: _, ...match } = rule.if ?? {};
 
                 for (const family of FortiOsFirewall.familiesOf(device, match)) {
                     const entry = root.block(family === "ipv4" ? "firewall acl" : "firewall acl6").entry(++counters[family]);
                     if (rule.description) entry.set("comments", FortiOsTree.quote(rule.description));
                     entry.set("interface", FortiOsTree.quote(FortiOsNames.nameOf(device, port)));
-                    entry.set("srcaddr", FortiOsTree.quote(objects.address(match?.src, undefined, family)));
-                    entry.set("dstaddr", FortiOsTree.quote(objects.address(match?.dst, undefined, family)));
+                    entry.set("srcaddr", FortiOsTree.quote(objects.address(FortiOsNames.single(match.src), undefined, family)));
+                    entry.set("dstaddr", FortiOsTree.quote(objects.address(FortiOsNames.single(match.dst), undefined, family)));
                     entry.set("service", FortiOsTree.quote(objects.service(match, family)));
                 }
             }
@@ -379,8 +391,8 @@ export class FortiOsFirewall {
     }
 
     /** Whether a port's ACL drops before it accepts: an accept before a drop is an exception the platform's ACLs cannot hold. */
-    static acceptsBeforeDrop(rules: readonly AclRule<string>[]): boolean {
-        const lastDrop = rules.map((rule) => rule.action).lastIndexOf("drop");
-        return rules.slice(0, Math.max(0, lastDrop)).some((rule) => rule.action === "accept");
+    static acceptsBeforeDrop(rules: readonly AclRule[]): boolean {
+        const lastDrop = rules.map((rule) => rule.then).lastIndexOf("drop");
+        return rules.slice(0, Math.max(0, lastDrop)).some((rule) => rule.then === "accept");
     }
 }