@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/src/platforms/fortios/index.ts

@@ -6,11 +6,13 @@ import type { Client, ClientChannel } from "ssh2";
 import { Address } from "../../core/address";
 import type { Neighbor } from "../../core/cabling";
 import { Secrets } from "../../core/secrets";
-import type { AclRule, Device, Family, FilterRule } from "../../schema";
+import type { AclRule, Device, Family, FilterRule, Gre, Lag, VlanInterface, Vxlan } from "../../model";
 import { SerialConsole, type ConsoleDialect } from "../../transport/console";
 import { Ssh } from "../../transport/ssh";
 import { Catalog } from "../catalog";
 import { Derive } from "../derive";
+import type { Finding } from "../finding";
+
 import { type ApplyOptions, type OsSupport, type Plan, type ReadOptions, type ReadSession, Platform } from "../platform";
 import { FortiOsFirewall } from "./firewall";
 import { FortiOsNames } from "./names";
@@ -129,6 +131,16 @@ export class FortiOsCli {
     }
 }
 
+/** The fields of a match that may hold a list or an interface set before Circuit writes them out. */
+type ListedMatch = {
+    src?: unknown;
+    dst?: unknown;
+    in_interface?: unknown;
+    out_interface?: unknown;
+    in_interface_set?: string;
+    out_interface_set?: string;
+};
+
 /** A failure after which the device reloads its saved configuration, which still says to revert. */
 class Reloaded extends Error {}
 
@@ -182,6 +194,11 @@ export class FortiOs extends Platform {
 
     override readonly console = FortiOs.CONSOLE;
 
+    /** A management VDOM that cannot work: named `root`, listing a LAG's port instead of the LAG, or with a route that leaves through an interface outside it or goes nowhere. */
+    checks(device: Device): Finding[] {
+        return FortiOsVdoms.problems(device).map((message) => ({ level: "error", device: device.name, message }));
+    }
+
     unsupported(device: Device): string[] {
         const found: string[] = [];
 
@@ -193,21 +210,34 @@ export class FortiOs extends Platform {
         found.push(...FortiOs.firewallGaps(device));
         found.push(...FortiOs.serviceGaps(device));
 
-        if (device.stp) found.push("stp, ports are routed");
+        if (device.switching?.stp) found.push("switching.stp, ports are routed");
         found.push(...FortiOs.transparentGaps(device));
         found.push(...FortiOsVdoms.gaps(device));
 
-        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-            if (iface.type === "vlan" && iface.mac) found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
+        for (const [name, iface] of Object.entries(device.interfaces?.vlan_interface ?? {})) {
+            if (iface?.mac) found.push(`interfaces.vlan_interface.${name}.mac, which only RouterOS sets for now`);
         }
-        if (Object.keys(device.vrfs ?? {}).length > FortiOsRender.VRFS) found.push(`vrfs, at most ${FortiOsRender.VRFS}`);
+        const vrfs = device.routing?.vrfs ?? {};
+        if (Object.keys(vrfs).length > FortiOsRender.VRFS) found.push(`routing.vrfs, at most ${FortiOsRender.VRFS}`);
 
-        for (const [name, vrf] of Object.entries(device.vrfs ?? {})) {
-            if (vrf.description) found.push(`vrfs.${name}.description, the platform numbers a VRF and keeps no description`);
+        for (const [name, vrf] of Object.entries(vrfs)) {
+            if (vrf?.description) found.push(`routing.vrfs.${name}.description, the platform numbers a VRF and keeps no description`);
         }
 
         // Proved on a FG-3700D on FortiOS 6.2.2, in NAT mode. BFD on a multihop BGP session is refused in FortiOsRouting.gaps, for the reason the device showed.
-        found.push(...Derive.unproved(device, ["bfd-timers", "static-route-bfd", "multihop-bfd"]));
+        // A management VDOM is rendered but not proved: `experimental()` gives it.
+        found.push(...Derive.unproved(device, ["bfd-timers", "static-route-bfd", "multihop-bfd", "management-vdom"]));
+
+        return found;
+    }
+
+    override experimental(device: Device): string[] {
+        const found: string[] = [];
+
+        if (device.system?.vdoms) found.push("system.vdoms, a management VDOM");
+        for (const route of device.routing?.static_routes ?? []) {
+            if (route.vrf && route.bfd) found.push(`routing.static_routes ${route.prefix}.bfd, BFD in a VRF`);
+        }
 
         return found;
     }
@@ -285,7 +315,7 @@ export class FortiOs extends Platform {
             await FortiOs.checkVersion(cli, device);
 
             const lines = FortiOs.fillLines(set, family, prefixes);
-            for (const line of device.vdoms ? FortiOsVdoms.wrap({ kind: "vdom", vdom: FortiOsVdoms.ROOT }, lines) : lines) {
+            for (const line of device.system?.vdoms ? FortiOsVdoms.wrap({ kind: "vdom", vdom: FortiOsVdoms.ROOT }, lines) : lines) {
                 let answer = await cli.run(line);
                 if (FortiOsCli.QUESTION.test(cli.prompt) && line === "purge") answer = await cli.answer("y");
                 if (FortiOs.REFUSED.test(answer)) throw new Error(`${set}: ${line}\n    device said: ${answer.trim().slice(0, 300)}`);
@@ -390,7 +420,7 @@ export class FortiOs extends Platform {
     private static async openConsole(device: Device) {
         const { console, user, password } = SerialConsole.of(device);
         const opened = await SerialConsole.open(console);
-        const login = () => SerialConsole.login(opened.channel, FortiOs.CONSOLE, user, password, console.passwordOnly);
+        const login = () => SerialConsole.login(opened.channel, FortiOs.CONSOLE, user, password, console.password_only);
 
         try {
             await login();
@@ -454,7 +484,7 @@ export class FortiOs extends Platform {
 
     /** Run `work` among the device's own settings: inside `config global` on a device with VDOMs, as it is on one without. */
     private static async inGlobal<T>(cli: FortiOsCli, device: Device | boolean, work: () => Promise<T>): Promise<T> {
-        const multi = typeof device === "boolean" ? device : Boolean(device.vdoms);
+        const multi = typeof device === "boolean" ? device : Boolean(device.system?.vdoms);
         if (!multi) return work();
 
         await cli.run("config global");
@@ -511,7 +541,7 @@ export class FortiOs extends Platform {
      */
     private static async readVdoms(cli: FortiOsCli, device: Device, show: (section: string) => Promise<string>): Promise<string[]> {
         const management = FortiOsVdoms.managementOf(device);
-        if (!management) throw new Error(`${device.name} runs several VDOMs and its config has no vdoms; write vdoms.management`);
+        if (!management) throw new Error(`${device.name} runs several VDOMs and its config has no vdoms; write system.vdoms.management`);
 
         const parts: string[] = [];
         const inVdom = async (vdom: string, sections: readonly string[]) => {
@@ -624,7 +654,7 @@ export class FortiOs extends Platform {
                 async (cli) => {
                     const reloaded = await FortiOs.inGlobal(cli, device, () => cli.run("execute cfg reload"));
                     if (!/no config to be reloaded/.test(reloaded)) return false;
-                    await FortiOs.saving(cli, "automatic", Boolean(device.vdoms));
+                    await FortiOs.saving(cli, "automatic", Boolean(device.system?.vdoms));
                     return true;
                 },
                 options
@@ -643,7 +673,7 @@ export class FortiOs extends Platform {
             if (options.console) {
                 await FortiOs.consoleSession(device, async (cli, relogin) => {
                     await FortiOs.checkVersion(cli, device);
-                    await FortiOs.configure(cli, plan, { seconds, prove: relogin }, Boolean(device.vdoms));
+                    await FortiOs.configure(cli, plan, { seconds, prove: relogin }, Boolean(device.system?.vdoms));
                 });
                 return;
             }
@@ -661,7 +691,7 @@ export class FortiOs extends Platform {
                             proof.end();
                         },
                     },
-                    Boolean(device.vdoms)
+                    Boolean(device.system?.vdoms)
                 );
             });
         } catch (error) {
@@ -684,8 +714,10 @@ export class FortiOs extends Platform {
             found.push(`connection.host, ${where}: only the management address, one IPv4 address outside the bridges`);
 
         const holders = [
-            ...Object.entries(device.ports ?? {}).map(([name, port]) => [`ports.${name}`, name, port?.addresses] as const),
-            ...Object.entries(device.interfaces ?? {}).map(([name, iface]) => [`interfaces.${name}`, name, iface.addresses] as const),
+            ...Derive.ports(device).map(([name, port]) => [`interfaces.ethernet.${name}`, name, port.addresses] as const),
+            ...FortiOsNames.interfacesOf(device).map(
+                ({ name, kind, settings }) => [`interfaces.${kind}.${name}`, name, settings.addresses] as const
+            ),
         ];
 
         for (const [path, name, addresses] of holders) {
@@ -699,22 +731,25 @@ export class FortiOs extends Platform {
         if (routing?.bgp || routing?.ospf) found.push(`routing, ${where}: static routes only`);
         if (routing?.bfd) found.push(`routing.bfd, ${where}: BFD is proved in NAT mode only`);
 
-        for (const [index, route] of (routing?.static ?? []).entries()) {
-            const at = `routing.static[${index}]`;
+        for (const [index, route] of (routing?.static_routes ?? []).entries()) {
+            const at = `routing.static_routes[${index}]`;
             if (!management) found.push(`${at}, ${where}: a route needs the management address`);
-            if (!route.via || Address.family(route.via) !== "ipv4" || route.interface || route.blackhole || route.vrf)
+            if (!route.next_hop || Address.family(route.next_hop) !== "ipv4" || route.interface || route.blackhole || route.vrf)
                 found.push(`${at}, ${where}: only an IPv4 next hop, for the management address`);
             if (route.bfd) found.push(`${at}.bfd, ${where}: BFD is proved in NAT mode only`);
         }
 
         if (device.firewall?.nat) found.push(`firewall.nat, ${where}`);
-        if (device.dhcp && Object.keys(device.dhcp).length) found.push(`dhcp, ${where}`);
+        if (device.services?.dhcp_server && Object.keys(device.services.dhcp_server).length) found.push(`services.dhcp_server, ${where}`);
 
         if (!management) {
             const services = device.management ?? {};
-            for (const service of ["ssh", "telnet", "http", "https", "api", "api_tls", "snmp", "native"] as const) {
+            for (const service of ["ssh", "telnet", "http", "https", "api", "api_tls"] as const) {
                 if (services[service]) found.push(`management.${service}, ${where}: the device has no management address to answer on`);
             }
+            if (device.monitoring?.snmp) found.push(`monitoring.snmp, ${where}: the device has no management address to answer on`);
+            if (services.native_protocol)
+                found.push(`management.native_protocol, ${where}: the device has no management address to answer on`);
         }
 
         return found;
@@ -727,17 +762,18 @@ export class FortiOs extends Platform {
         if (system.timezone && !FortiOsRender.zoneOf(system.timezone))
             found.push(`system.timezone ${system.timezone}, the platform has no zone for it`);
         if (system.release_channel) found.push("system.release_channel, the platform's firmware has no release channel to follow");
-        if (system.transceiver_monitoring !== undefined)
-            found.push("system.transceiver_monitoring, the platform reads optics without being told");
-        if (system.ip?.syn_cookies) found.push("system.ip.syn_cookies, the platform has a SYN proxy per DoS policy, not SYN cookies");
+        if (device.monitoring?.transceivers !== undefined)
+            found.push("monitoring.transceivers, the platform reads optics without being told");
+        if (system.ip_stack?.syn_cookies)
+            found.push("system.ip_stack.syn_cookies, the platform has a SYN proxy per DoS policy, not SYN cookies");
 
         const local = system.logging?.local;
         if (local?.files !== undefined || local?.lines_per_file !== undefined) {
             found.push("system.logging.local.files and lines_per_file, logs kept in memory do not rotate into files");
         }
 
-        if ((system.logging?.remote?.length ?? 0) > FortiOsRender.COLLECTORS)
-            found.push(`system.logging.remote, at most ${FortiOsRender.COLLECTORS} collectors`);
+        if ((device.monitoring?.syslog?.length ?? 0) > FortiOsRender.COLLECTORS)
+            found.push(`monitoring.syslog, at most ${FortiOsRender.COLLECTORS} collectors`);
 
         const servers = system.dns?.servers ?? [];
         for (const family of ["ipv4", "ipv6"] as const) {
@@ -757,19 +793,20 @@ export class FortiOs extends Platform {
         if (management.ftp) found.push("management.ftp, the platform has no FTP service");
         if (management.console) found.push("management.console, the console logs in with the device's users");
         if (management.privilege_password) found.push("management.privilege_password, the platform has no privileged mode");
-        if (management.native?.interfaces?.length) found.push("management.native.interfaces, FortiManager access runs over IP only");
-        if (management.native?.port) found.push("management.native.port, FortiManager access listens on 541");
+        if (management.native_protocol?.interfaces?.length)
+            found.push("management.native_protocol.interfaces, FortiManager access runs over IP only");
+        if (management.native_protocol?.port) found.push("management.native_protocol.port, FortiManager access listens on 541");
         if (management.ssh?.auth_retries)
             found.push("management.ssh.auth_retries, the platform counts failed logins per source, not per connection");
 
-        for (const [name, user] of Object.entries(management.snmp?.users ?? {})) {
+        for (const [name, user] of Object.entries(device.monitoring?.snmp?.users ?? {})) {
             if (user.auth === "sha256")
-                found.push(`management.snmp.users.${name}.auth sha256, the platform authenticates with SHA1 or MD5`);
+                found.push(`monitoring.snmp.users.${name}.auth sha256, the platform authenticates with SHA1 or MD5`);
         }
 
-        for (const [name, user] of Object.entries(device.users ?? {})) {
-            if ((user.ssh_keys?.length ?? 0) > FortiOsRender.SSH_KEYS)
-                found.push(`users.${name}.ssh_keys, at most ${FortiOsRender.SSH_KEYS}`);
+        for (const [name, user] of Object.entries(device.system?.users ?? {})) {
+            if ((user?.ssh_keys?.length ?? 0) > FortiOsRender.SSH_KEYS)
+                found.push(`system.users.${name}.ssh_keys, at most ${FortiOsRender.SSH_KEYS}`);
         }
 
         return found;
@@ -783,17 +820,13 @@ export class FortiOs extends Platform {
     private static interfaceGaps(device: Device): string[] {
         const found: string[] = [];
         const vlanInterfaces = new Set(
-            Object.values(device.interfaces ?? {}).flatMap((iface) => (iface.type === "vlan" ? [iface.vlan as string] : []))
+            Object.values(device.interfaces?.vlan_interface ?? {}).flatMap((iface) => (iface ? [iface.vlan] : []))
         );
 
-        for (const [name, vlan] of Object.entries(device.vlans ?? {})) {
-            if (vlan.description) found.push(`vlans.${name}.description, a VLAN interface holds its own`);
-        }
-
-        for (const [name, port] of Object.entries(device.ports ?? {})) {
-            if (!port) continue;
+        // A VLAN's description is dropped, as `switching.vlans` says: the platform knows a VLAN by its number, and a VLAN interface holds a description of its own.
 
-            const where = `ports.${name}`;
+        for (const [name, port] of Derive.ports(device)) {
+            const where = `interfaces.ethernet.${name}`;
             const speedClass = name.split("-")[0]!;
             if (port.speed && !FortiOsRender.SPEEDS[speedClass]?.[port.speed])
                 found.push(`${where}.speed ${port.speed}, not in a ${speedClass} cage`);
@@ -805,14 +838,14 @@ export class FortiOs extends Platform {
             if (port.hardware_offload !== undefined)
                 found.push(`${where}.hardware_offload, offload is decided per policy, which can match many interfaces`);
 
-            if (port.lag) {
-                for (const field of ["addresses", "mtu", "vrrp", "vrf", "lldp", "trunk_vlans", "ipv6_ra", "acl"] as const) {
+            if (port.in_lag) {
+                for (const field of ["addresses", "mtu", "vrrp", "vrf", "lldp", "trunk_vlans", "ipv6_ra", "ingress_acl"] as const) {
                     if (port[field] !== undefined) found.push(`${where}.${field}, a LAG member takes its settings from the LAG`);
                 }
             }
 
-            const acl = port.acl ? device.acls?.[port.acl] : undefined;
-            if (acl) found.push(...FortiOs.aclGaps(`acls.${port.acl}`, acl));
+            const acl = port.ingress_acl ? device.switching?.acls?.[port.ingress_acl] : undefined;
+            if (acl) found.push(...FortiOs.aclGaps(`switching.acls.${port.ingress_acl}`, acl));
 
             found.push(...FortiOs.trunkGaps(where, name, port.trunk_vlans, vlanInterfaces, device));
             found.push(...FortiOs.routedGaps(where, port, false));
@@ -820,10 +853,10 @@ export class FortiOs extends Platform {
 
         const ports = FortiOs.portNames(device);
 
-        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-            const where = `interfaces.${name}`;
+        for (const { name, kind, settings: iface } of FortiOsNames.interfacesOf(device)) {
+            const where = `interfaces.${kind}.${name}`;
 
-            if (iface.type === "wireguard") {
+            if (kind === "wireguard") {
                 found.push(`${where}, a wireguard: the platform has no WireGuard`);
                 continue;
             }
@@ -835,32 +868,38 @@ export class FortiOs extends Platform {
             if (iface.hardware_offload !== undefined)
                 found.push(`${where}.hardware_offload, offload is decided per policy, which can match many interfaces`);
 
-            if (iface.type === "lag") {
-                if (iface.id !== undefined) found.push(`${where}.id, the platform names a LAG by its key`);
+            if (kind === "lag") {
+                const lag = iface as Lag;
+                if (lag.id !== undefined) found.push(`${where}.id, the platform names a LAG by its key`);
                 for (const field of ["access_vlan", "native_vlan", "stp", "storm_control"] as const) {
-                    if (iface[field] !== undefined) found.push(`${where}.${field}, LAGs are routed`);
+                    if (lag[field] !== undefined) found.push(`${where}.${field}, LAGs are routed`);
                 }
 
-                found.push(...FortiOs.trunkGaps(where, name, iface.trunk_vlans, vlanInterfaces, device));
+                found.push(...FortiOs.trunkGaps(where, name, lag.trunk_vlans, vlanInterfaces, device));
             }
 
-            if (iface.type === "vlan" && !FortiOsRender.vlanParent(device, iface.vlan)) {
-                found.push(`${where}, VLAN ${iface.vlan} must be carried tagged by exactly one port or LAG`);
+            if (kind === "vlan_interface") {
+                const vlan = (iface as VlanInterface).vlan;
+                if (!FortiOsRender.vlanParent(device, vlan))
+                    found.push(`${where}, VLAN ${vlan} must be carried tagged by exactly one port or LAG`);
             }
 
-            if (iface.type === "loopback") {
+            if (kind === "loopback") {
                 if (iface.mtu !== undefined) found.push(`${where}.mtu, a loopback has no MTU of its own`);
                 if (iface.vrrp?.length) found.push(`${where}.vrrp, a loopback runs no VRRP`);
             }
 
-            if (iface.type === "gre" || iface.type === "vxlan") {
-                if (!FortiOsNames.holderOf(device, iface.local)) found.push(`${where}.local, no interface holds ${iface.local}`);
-                if (Address.family(iface.local) !== Address.family(iface.remote)) found.push(`${where}, endpoints of two families`);
-                if (iface.vrrp?.length) found.push(`${where}.vrrp, on a tunnel`);
-                if (iface.ipv6_ra) found.push(`${where}.ipv6_ra, on a tunnel`);
+            if (kind === "gre" || kind === "vxlan") {
+                const tunnel = iface as Gre | Vxlan;
+                if (!FortiOsNames.holderOf(device, tunnel.local_address))
+                    found.push(`${where}.local_address, no interface holds ${tunnel.local_address}`);
+                if (Address.family(tunnel.local_address) !== Address.family(tunnel.remote_address))
+                    found.push(`${where}, endpoints of two families`);
+                if (tunnel.vrrp?.length) found.push(`${where}.vrrp, on a tunnel`);
+                if (tunnel.ipv6_ra) found.push(`${where}.ipv6_ra, on a tunnel`);
             }
 
-            if (iface.type === "gre") {
+            if (kind === "gre") {
                 for (const entry of iface.addresses ?? []) {
                     if (typeof entry !== "string" && Address.family(Address.host(entry.address)) === "ipv6")
                         found.push(`${where}.addresses, a peer on an IPv6 address`);
@@ -874,14 +913,15 @@ export class FortiOs extends Platform {
                 if (ipv4.length > 1) found.push(`${where}.addresses, one IPv4 address`);
             }
 
-            found.push(...FortiOs.routedGaps(where, iface, iface.type === "gre"));
+            found.push(...FortiOs.routedGaps(where, iface, kind === "gre"));
         }
 
         // LLDP runs on ports and aggregates; a VLAN interface has no LLDP settings.
-        if (device.lldp && typeof device.lldp === "object") {
-            for (const name of device.lldp.interfaces) {
-                const settings = device.interfaces?.[name];
-                if (settings && settings.type !== "lag") found.push(`lldp.interfaces ${name}, a ${settings.type}`);
+        const lldp = device.switching?.lldp;
+        if (lldp && typeof lldp === "object") {
+            for (const name of lldp.interfaces) {
+                const kind = FortiOsNames.interfacesOf(device).find((entry) => entry.name === name)?.kind;
+                if (kind && kind !== "lag") found.push(`switching.lldp.interfaces ${name}, a ${kind}`);
             }
         }
 
@@ -913,7 +953,7 @@ export class FortiOs extends Platform {
     private static routedGaps(
         where: string,
         settings: {
-            addresses?: readonly (string | { address: string; peer: string })[];
+            addresses?: readonly (string | { address: string; peer_address: string })[];
             vrrp?: readonly { id: number; address: string }[];
         },
         tunnel: boolean
@@ -931,42 +971,57 @@ export class FortiOs extends Platform {
     }
 
     /** An ACL as the platform's, which only drop: every drop comes before any accept, and no rule limits a rate or matches a VLAN. */
-    private static aclGaps(where: string, rules: readonly AclRule<string>[]): string[] {
+    private static aclGaps(where: string, rules: readonly AclRule[]): string[] {
         const found: string[] = [];
 
         if (FortiOsFirewall.acceptsBeforeDrop(rules)) found.push(`${where}, an accept before a drop: the platform's ACLs only drop`);
 
         rules.forEach((rule, index) => {
             if (rule.rate) found.push(`${where}[${index}].rate`);
-            if (rule.match?.vlan) found.push(`${where}[${index}].match.vlan, a port's ACL sees no VLAN`);
+            if (rule.if?.vlan) found.push(`${where}[${index}].if.vlan, a port's ACL sees no VLAN`);
+            found.push(...FortiOs.listGaps(`${where}[${index}]`, rule.if));
         });
 
         return found;
     }
 
+    /** Lists in a rule's match where the platform takes one value, and interface sets: Circuit writes them out as one rule per value before the platform reads them. */
+    private static listGaps(where: string, match: ListedMatch | undefined): string[] {
+        const found: string[] = [];
+
+        for (const field of ["src", "dst", "in_interface", "out_interface"] as const) {
+            const value = match?.[field];
+            if (Array.isArray(value) && value.length > 1) found.push(`${where}.if.${field}, a list: the platform takes one value here`);
+        }
+        for (const field of ["in_interface_set", "out_interface_set"] as const) {
+            if (match?.[field] !== undefined) found.push(`${where}.if.${field}, which Circuit writes out as its interfaces`);
+        }
+
+        return found;
+    }
+
     private static staticGaps(device: Device): string[] {
         const found: string[] = [];
         const seen = new Set<string>();
 
-        for (const route of device.routing?.static ?? []) {
-            const where = `routing.static ${route.prefix}`;
+        for (const route of device.routing?.static_routes ?? []) {
+            const where = `routing.static_routes ${route.prefix}`;
 
-            if (route.vrf && route.bfd) found.push(`${where}.bfd, BFD in a VRF is not proved on a device yet`);
             if (route.vrf && route.blackhole)
                 found.push(`${where}, a blackhole in a VRF: a route takes the VRF of the interface it leaves through`);
             if (route.vrf && route.interface && FortiOsNames.settingsOf(device, route.interface)?.vrf !== route.vrf) {
                 found.push(`${where}.interface, which is not in VRF ${route.vrf}`);
             }
 
-            if (route.via && !route.interface && !route.blackhole && !FortiOsNames.interfaceFor(device, route.via, route.vrf)) {
-                found.push(`${where} via ${route.via}, no interface's own network in its table holds the next hop`);
+            if (route.next_hop && !route.interface && !route.blackhole && !FortiOsNames.interfaceFor(device, route.next_hop, route.vrf)) {
+                found.push(`${where} next_hop ${route.next_hop}, no interface's own network in its table holds the next hop`);
             }
 
             // The device refuses a second route identical to one it has: `Duplicated entry`.
             const key = [
                 Address.split(route.prefix).addr,
                 Address.split(route.prefix).len,
-                route.via,
+                route.next_hop,
                 route.interface,
                 route.blackhole,
                 route.distance,
@@ -986,65 +1041,71 @@ export class FortiOs extends Platform {
 
         if (fw.filter?.output) found.push("firewall.filter.output, the platform filters no traffic it sends itself");
         if (fw.untracked) found.push("firewall.untracked, every session is tracked");
+        if (fw.interface_sets) found.push("firewall.interface_sets, which Circuit writes out as each rule's interfaces");
 
-        for (const helper of fw.helpers ?? []) {
-            if (!FortiOsRender.HELPERS[helper]) found.push(`firewall.helpers ${helper}, the platform has no helper for it`);
+        for (const helper of fw.conntrack_helpers ?? []) {
+            if (!FortiOsRender.HELPERS[helper]) found.push(`firewall.conntrack_helpers ${helper}, the platform has no helper for it`);
         }
 
         for (const chain of ["forward", "input"] as const) {
             (fw.filter?.[chain]?.rules ?? []).forEach((rule, index) =>
-                found.push(...FortiOs.ruleGaps(`firewall.filter.${chain}[${index}]`, rule, chain, device))
+                found.push(...FortiOs.ruleGaps(`firewall.filter.${chain}.rules[${index}]`, rule, chain, device))
             );
         }
 
         (fw.nat?.source ?? []).forEach((rule, index) => {
             const where = `firewall.nat.source[${index}]`;
-            const match = rule.match;
+            const match = rule.if;
+            found.push(...FortiOs.listGaps(where, match));
 
             if (FortiOsFirewall.familiesOf(device, match).includes("ipv6") && (match?.family === "ipv6" || match?.src || match?.dst)) {
                 found.push(`${where}, IPv6: central NAT translates IPv4`);
             }
 
-            if (rule.action === "dnat") found.push(`${where}.action dnat, in source NAT`);
-            if (rule.action === "snat" && Address.family(rule.to) === "ipv6") found.push(`${where}.to, IPv6: central NAT translates IPv4`);
-            if (match?.dst_port !== undefined) found.push(`${where}.match.dst_port, central NAT matches the source port only`);
-            if (Array.isArray(match?.src_port)) found.push(`${where}.match.src_port, one port or range`);
-            if (rule.action === "snat" && rule.to_port !== undefined && match?.src_port === undefined)
-                found.push(`${where}.to_port, without match.src_port`);
-            if ((match?.src && match.src_set) || (match?.dst && match.dst_set))
-                found.push(`${where}.match, a prefix and a set on one side`);
-            if (match?.state || match?.tcp_flags) found.push(`${where}.match.state and tcp_flags`);
+            if (rule.then === "dnat") found.push(`${where}.then dnat, in source NAT`);
+            if (rule.then === "snat" && Address.family(rule.to_address) === "ipv6")
+                found.push(`${where}.to_address, IPv6: central NAT translates IPv4`);
+            if (match?.dst_port !== undefined) found.push(`${where}.if.dst_port, central NAT matches the source port only`);
+            if (Array.isArray(match?.src_port)) found.push(`${where}.if.src_port, one port or range`);
+            if (rule.then === "snat" && rule.to_port !== undefined && match?.src_port === undefined)
+                found.push(`${where}.to_port, without if.src_port`);
+            if ((match?.src && match.src_address_set) || (match?.dst && match.dst_address_set))
+                found.push(`${where}.if, a prefix and a set on one side`);
+            if (match?.connection_state || match?.tcp_flags) found.push(`${where}.if.connection_state and tcp_flags`);
         });
 
         (fw.nat?.destination ?? []).forEach((rule, index) => {
             const where = `firewall.nat.destination[${index}]`;
-            const match = rule.match;
+            const match = rule.if;
+            found.push(...FortiOs.listGaps(where, match));
 
-            if (rule.action !== "dnat") {
-                found.push(`${where}.action ${rule.action}, in destination NAT`);
+            if (rule.then !== "dnat") {
+                found.push(`${where}.then ${rule.then}, in destination NAT`);
                 return;
             }
 
-            if (!match?.dst || Address.split(match.dst.includes("/") ? match.dst : `${match.dst}/32`).len !== 32) {
-                found.push(`${where}.match.dst, one IPv4 address the virtual IP answers on`);
+            const dst = FortiOsNames.single(match?.dst);
+            if (!dst || Address.split(dst.includes("/") ? dst : `${dst}/32`).len !== 32) {
+                found.push(`${where}.if.dst, one IPv4 address the virtual IP answers on`);
             }
 
-            const sources = match?.src ? [match.src] : match?.src_set ? (fw.address_sets?.[match.src_set] ?? []) : [];
-            if (Address.family(rule.to) === "ipv6" || sources.some((source) => Address.family(Address.host(source)) === "ipv6"))
+            const src = FortiOsNames.single(match?.src);
+            const sources = src ? [src] : match?.src_address_set ? (fw.address_sets?.[match.src_address_set] ?? []) : [];
+            if (Address.family(rule.to_address) === "ipv6" || sources.some((source) => Address.family(Address.host(source)) === "ipv6"))
                 found.push(`${where}, IPv6`);
-            if (match?.dst_port !== undefined && Array.isArray(match.dst_port)) found.push(`${where}.match.dst_port, one port or range`);
+            if (match?.dst_port !== undefined && Array.isArray(match.dst_port)) found.push(`${where}.if.dst_port, one port or range`);
             if (match?.dst_port !== undefined && match.protocol !== "tcp" && match.protocol !== "udp") {
-                found.push(`${where}.match.protocol, tcp or udp with a port`);
+                found.push(`${where}.if.protocol, tcp or udp with a port`);
             }
 
             if (match?.dst_port === undefined && (match?.protocol || rule.to_port)) {
-                found.push(`${where}.match.dst_port, a protocol or port is forwarded by its port`);
+                found.push(`${where}.if.dst_port, a protocol or port is forwarded by its port`);
             }
 
-            if (match?.src && match.src_set) found.push(`${where}.match, a prefix and a set on one side`);
+            if (match?.src && match.src_address_set) found.push(`${where}.if, a prefix and a set on one side`);
 
-            for (const field of ["dst_set", "src_port", "out_interface", "state", "tcp_flags", "family"] as const) {
-                if (match?.[field] !== undefined) found.push(`${where}.match.${field}`);
+            for (const field of ["dst_address_set", "src_port", "out_interface", "connection_state", "tcp_flags", "family"] as const) {
+                if (match?.[field] !== undefined) found.push(`${where}.if.${field}`);
             }
         });
 
@@ -1059,35 +1120,39 @@ export class FortiOs extends Platform {
     }
 
     /** A filter rule the platform cannot express. */
-    private static ruleGaps(where: string, rule: FilterRule<string, string>, chain: "forward" | "input", device: Device): string[] {
+    private static ruleGaps(where: string, rule: FilterRule, chain: "forward" | "input", device: Device): string[] {
         const found: string[] = [];
-        const match = rule.match;
-        const state = match?.state ?? [];
+        const match = rule.if;
+        const state = match?.connection_state ?? [];
 
         // The platform is stateful: replies pass on their own, and a rule matches a session's first packet.
-        if (state.some((one) => one === "invalid" || one === "untracked")) found.push(`${where}.match.state ${state.join(", ")}`);
-        else if (state.length && rule.action !== "accept") found.push(`${where}.match.state, on a rule that does not accept`);
+        if (state.some((one) => one === "invalid" || one === "untracked")) found.push(`${where}.if.connection_state ${state.join(", ")}`);
+        else if (state.length && rule.then !== "accept") found.push(`${where}.if.connection_state, on a rule that does not accept`);
 
-        if (match?.tcp_flags) found.push(`${where}.match.tcp_flags, the platform matches no TCP flags`);
-        if ((match?.src && match.src_set) || (match?.dst && match.dst_set)) found.push(`${where}.match, a prefix and a set on one side`);
+        if (match?.tcp_flags) found.push(`${where}.if.tcp_flags, the platform matches no TCP flags`);
+        if ((match?.src && match.src_address_set) || (match?.dst && match.dst_address_set))
+            found.push(`${where}.if, a prefix and a set on one side`);
+        found.push(...FortiOs.listGaps(where, match));
         if (FortiOsFirewall.isImplied(rule)) return found;
 
         const families = FortiOsFirewall.familiesOf(device, match);
         if (!families.length) found.push(`${where}, its addresses share no family`);
 
-        if (match?.src && match.dst && Address.family(Address.host(match.src)) !== Address.family(Address.host(match.dst))) {
+        const src = FortiOsNames.single(match?.src);
+        const dst = FortiOsNames.single(match?.dst);
+        if (src && dst && Address.family(Address.host(src)) !== Address.family(Address.host(dst))) {
             found.push(`${where}, a source and destination of two families`);
         }
 
         for (const family of families) {
             if (FortiOsFirewall.serviceOf(match, family).name.length > FortiOs.NAME_LENGTH.object)
-                found.push(`${where}.match ports, too many for one service`);
+                found.push(`${where}.if ports, too many for one service`);
         }
 
         if (chain === "input") {
-            if (match?.out_interface) found.push(`${where}.match.out_interface, on traffic to the device`);
-            if (rule.action === "reject") found.push(`${where}.action reject, the platform drops traffic to itself silently`);
-            if (rule.offload) found.push(`${where}.offload, on traffic to the device`);
+            if (match?.out_interface) found.push(`${where}.if.out_interface, on traffic to the device`);
+            if (rule.then === "reject") found.push(`${where}.then reject, the platform drops traffic to itself silently`);
+            if (rule.fast_path) found.push(`${where}.fast_path, on traffic to the device`);
         }
 
         return found;
@@ -1096,25 +1161,24 @@ export class FortiOs extends Platform {
     private static serviceGaps(device: Device): string[] {
         const found: string[] = [];
 
-        for (const [name, server] of Object.entries(device.dhcp ?? {})) {
+        for (const [name, server] of Object.entries(device.services?.dhcp_server ?? {})) {
             if (Address.family(Address.host(server.network)) === "ipv6")
-                found.push(`dhcp.${name}.network, IPv6: DHCPv6 hands out no gateway`);
+                found.push(`services.dhcp_server.${name}.network, IPv6: DHCPv6 hands out no gateway`);
             if ((server.dns?.length ?? 0) > FortiOsRender.RESOLVERS.dhcp)
-                found.push(`dhcp.${name}.dns, at most ${FortiOsRender.RESOLVERS.dhcp}`);
+                found.push(`services.dhcp_server.${name}.dns, at most ${FortiOsRender.RESOLVERS.dhcp}`);
         }
 
-        const flow = device.flow_export;
-        if (flow?.protocol === "ipfix") found.push("flow_export.protocol ipfix, the platform exports sFlow and NetFlow 9");
-        if (flow && flow.collectors.length > 1) found.push("flow_export.collectors, one collector");
+        const flow = device.monitoring?.flow_export;
+        if (flow?.protocol === "ipfix") found.push("monitoring.flow_export.protocol ipfix, the platform exports sFlow and NetFlow 9");
+        if (flow && flow.collectors.length > 1) found.push("monitoring.flow_export.collectors, one collector");
         for (const name of flow?.interfaces ?? []) {
-            const type = device.interfaces?.[name]?.type;
-            if (type === "gre" || type === "vxlan")
-                found.push(`flow_export.interfaces ${name}, a tunnel: the platform samples the interface it leaves through`);
+            if (FortiOsNames.isTunnel(device, name))
+                found.push(`monitoring.flow_export.interfaces ${name}, a tunnel: the platform samples the interface it leaves through`);
         }
         if (flow?.protocol === "netflow-v9" && flow.sampling !== undefined)
-            found.push("flow_export.sampling, NetFlow here exports every flow");
+            found.push("monitoring.flow_export.sampling, NetFlow here exports every flow");
         if (flow?.protocol === "sflow" && (flow.sampling === undefined || flow.sampling < 10 || flow.sampling > 99999)) {
-            found.push("flow_export.sampling, required and from 10 to 99999: the platform samples");
+            found.push("monitoring.flow_export.sampling, required and from 10 to 99999: the platform samples");
         }
 
         return found;