@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/src/platforms/fortios/routing.ts

@@ -2,13 +2,10 @@
 
 import { Address } from "../../core/address";
 import { Secrets } from "../../core/secrets";
-import type { Device, Family, Neighbor, NeighborSettings, PolicyRule } from "../../schema";
+import type { Device, Family, Neighbor, NeighborSettings, PolicyRule, PrefixSet, RouteRule } from "../../model";
 import { FortiOsNames } from "./names";
 import { FortiOsBlock, FortiOsTree } from "./tree";
 
-type AnyRule = PolicyRule<string, string>;
-type AnyNeighbor = Neighbor<string, string, string>;
-
 /** The lengths a prefix list's rule takes within its prefix. */
 type Lengths = { ge?: number; le?: number };
 
@@ -59,8 +56,8 @@ class RouteMaps {
         return name;
     }
 
-    private rule(entry: FortiOsBlock, rule: AnyRule, family: Family, label: string): void {
-        const match = rule.match ?? {};
+    private rule(entry: FortiOsBlock, rule: RouteRule, family: Family, label: string): void {
+        const match = rule.if ?? {};
         const set = rule.set ?? {};
         const address = family === "ipv4" ? "match-ip-address" : "match-ip6-address";
         const bits = FortiOsRouting.BITS[family];
@@ -90,27 +87,29 @@ class RouteMaps {
             entry.set(address, FortiOsTree.quote(name));
         }
 
-        if (match.community)
+        if (match.standard_community)
             entry.set(
                 "match-community",
-                FortiOsTree.quote(this.communities(`circuit-match-${RouteMaps.slug(match.community)}`, [match.community], false))
+                FortiOsTree.quote(
+                    this.communities(`circuit-match-${RouteMaps.slug(match.standard_community)}`, [match.standard_community], false)
+                )
             );
 
         if (set.local_pref !== undefined) entry.set("set-local-preference", set.local_pref);
         if (set.med !== undefined) entry.set("set-metric", set.med);
         if (set.prepend !== undefined)
-            entry.set("set-aspath", FortiOsTree.quote(Array(set.prepend).fill(this.device.routing!.bgp!.asn).join(" ")));
+            entry.set("set-aspath", FortiOsTree.quote(Array(set.prepend).fill(this.device.routing?.bgp?.asn).join(" ")));
 
         // Replacing the communities makes removing some needless; added ones join the new ones.
-        if (set.communities) {
-            entry.set("set-community", FortiOsTree.quoteAll([...set.communities, ...(set.add_communities ?? [])]));
+        if (set.standard_communities) {
+            entry.set("set-community", FortiOsTree.quoteAll([...set.standard_communities, ...(set.add_standard_communities ?? [])]));
         } else {
-            if (set.add_communities)
-                entry.set("set-community", FortiOsTree.quoteAll(set.add_communities)).set("set-community-additive", "enable");
+            if (set.add_standard_communities)
+                entry.set("set-community", FortiOsTree.quoteAll(set.add_standard_communities)).set("set-community-additive", "enable");
 
-            if (set.remove_communities) {
-                const name = `circuit-remove-${RouteMaps.slug(set.remove_communities.join(" "))}`;
-                entry.set("set-community-delete", FortiOsTree.quote(this.communities(name, set.remove_communities, true)));
+            if (set.remove_standard_communities) {
+                const name = `circuit-remove-${RouteMaps.slug(set.remove_standard_communities.join(" "))}`;
+                entry.set("set-community-delete", FortiOsTree.quote(this.communities(name, set.remove_standard_communities, true)));
             }
         }
 
@@ -118,13 +117,12 @@ class RouteMaps {
             entry.set(family === "ipv4" ? "set-ip-nexthop" : "set-ip6-nexthop", set.next_hop);
 
         // Permit is the default and is not printed.
-        if (rule.action === "reject") entry.set("action", "deny");
+        if (rule.then === "reject") entry.set("action", "deny");
     }
 
     /** The prefixes of a set the config lists. */
     private prefixesOf(set: string): string[] {
-        const prefixes = this.device.prefix_sets?.[set];
-        return prefixes && "prefixes" in prefixes ? [...prefixes.prefixes] : [];
+        return FortiOsRouting.listed(this.device.routing?.prefix_sets?.[set]) ?? [];
     }
 
     /** A prefix list of its own, rule by rule; a prefix no length fits is left out. */
@@ -167,19 +165,25 @@ export class FortiOsRouting {
     static readonly BITS = { ipv4: 32, ipv6: 128 } as const;
 
     /** A neighbor's settings with its group's beneath them. */
-    static neighborSettings(device: Device, neighbor: AnyNeighbor): NeighborSettings<string, string> {
-        const group = neighbor.group ? device.routing?.bgp?.groups?.[neighbor.group] : undefined;
+    static neighborSettings(device: Device, neighbor: Neighbor): NeighborSettings {
+        const group = neighbor.neighbor_group ? device.routing?.bgp?.neighbor_groups?.[neighbor.neighbor_group] : undefined;
         return { ...group, ...neighbor };
     }
 
     /** The families a session carries: its own, or the family of its address. */
-    static familiesOfNeighbor(device: Device, neighbor: AnyNeighbor): Family[] {
-        return [...(FortiOsRouting.neighborSettings(device, neighbor).families ?? [Address.family(neighbor.address)])];
+    static familiesOfNeighbor(device: Device, neighbor: Neighbor): Family[] {
+        return [...(FortiOsRouting.neighborSettings(device, neighbor).address_families ?? [Address.family(neighbor.address)])];
+    }
+
+    /** The prefixes a set lists, from a list or a map of named prefixes; undefined for a set a registry fills. */
+    static listed(set: PrefixSet | undefined): string[] | undefined {
+        if (!set || !("prefixes" in set)) return undefined;
+        return Array.isArray(set.prefixes) ? [...set.prefixes] : Object.values(set.prefixes);
     }
 
     /** Whether a static route, OSPF or BGP detects a dead neighbor with BFD, which the device then runs. */
     static usesBfd(device: Device): boolean {
-        const routes = (device.routing?.static ?? []).some((route) => route.bfd);
+        const routes = (device.routing?.static_routes ?? []).some((route) => route.bfd);
         const areas = Object.values(device.routing?.ospf?.areas ?? {});
         const ospf = areas.some((area) => Object.values(area.interfaces).some((settings) => settings?.bfd));
         const bgp = Object.values(device.routing?.bgp?.neighbors ?? {}).some(
@@ -219,7 +223,9 @@ export class FortiOsRouting {
 
     /** Each prefix set as a prefix list matching its prefixes and any more specific. One a registry fills starts with a rule that denies every prefix, so it matches nothing until `refresh` fills it. */
     private static prefixLists(root: FortiOsBlock, device: Device): void {
-        for (const [name, set] of Object.entries(device.prefix_sets ?? {})) {
+        for (const [name, set] of Object.entries(device.routing?.prefix_sets ?? {})) {
+            if (!set) continue;
+
             if ("source" in set) {
                 const { registry, query, family } = set.source;
                 const entry = root
@@ -233,9 +239,10 @@ export class FortiOsRouting {
                 continue;
             }
 
-            const family = set.prefixes[0] ? FortiOsNames.familyOfPrefix(set.prefixes[0]) : "ipv4";
+            const prefixes = FortiOsRouting.listed(set) ?? [];
+            const family = prefixes[0] ? FortiOsNames.familyOfPrefix(prefixes[0]) : "ipv4";
             const entry = root.block(FortiOsRouting.PREFIX_LIST[family]).entry(name);
-            set.prefixes.forEach((prefix, index) =>
+            prefixes.forEach((prefix, index) =>
                 FortiOsRouting.listRule(entry.block("rule").entry(index + 1), family, prefix, FortiOsRouting.bounds(prefix, family))
             );
         }
@@ -251,7 +258,7 @@ export class FortiOsRouting {
     /** OSPF for IPv4. An area runs on the networks of its interfaces; an interface named with a cost, a link type or BFD has settings of its own; a passive one forms no adjacency. */
     private static ospf(root: FortiOsBlock, device: Device): void {
         const ospf = device.routing?.ospf;
-        if (!ospf || !(ospf.families ?? ["ipv4"]).includes("ipv4")) return;
+        if (!ospf || !(ospf.address_families ?? ["ipv4"]).includes("ipv4")) return;
 
         const block = root.block("router ospf");
         if (device.routing?.router_id) block.set("router-id", device.routing.router_id);
@@ -290,7 +297,7 @@ export class FortiOsRouting {
     /** OSPFv3 for IPv6. Every interface of an area runs it in that area. */
     private static ospf6(root: FortiOsBlock, device: Device): void {
         const ospf = device.routing?.ospf;
-        if (!ospf?.families?.includes("ipv6")) return;
+        if (!ospf?.address_families?.includes("ipv6")) return;
 
         const block = root.block("router ospf6");
         if (device.routing?.router_id) block.set("router-id", device.routing.router_id);
@@ -323,12 +330,14 @@ export class FortiOsRouting {
         if (!bgp) return;
 
         const block = root.block("router bgp");
-        block.set("as", bgp.asn);
+        if (bgp.asn !== undefined) block.set("as", bgp.asn);
         if (device.routing?.router_id) block.set("router-id", device.routing.router_id);
 
         const maps = new RouteMaps(root, device);
 
         for (const neighbor of Object.values(bgp.neighbors ?? {})) {
+            if (!neighbor) continue;
+
             const settings = FortiOsRouting.neighborSettings(device, neighbor);
             const families = FortiOsRouting.familiesOfNeighbor(device, neighbor);
             const entry = block.block("neighbor").entry(neighbor.address);
@@ -345,8 +354,8 @@ export class FortiOsRouting {
             for (const family of families) {
                 const suffix = family === "ipv4" ? "" : "6";
                 if (settings.max_prefixes !== undefined) entry.set(`maximum-prefix${suffix}`, settings.max_prefixes);
-                entry.set(`route-map-in${suffix}`, FortiOsTree.quote(maps.of(settings.import, family)));
-                entry.set(`route-map-out${suffix}`, FortiOsTree.quote(maps.of(settings.export, family)));
+                entry.set(`route-map-in${suffix}`, FortiOsTree.quote(maps.of(settings.import_policy, family)));
+                entry.set(`route-map-out${suffix}`, FortiOsTree.quote(maps.of(settings.export_policy, family)));
             }
 
             if (settings.keepalive !== undefined) entry.set("keep-alive-timer", settings.keepalive);
@@ -360,7 +369,7 @@ export class FortiOsRouting {
 
         const networks = { ipv4: 0, ipv6: 0 };
 
-        for (const prefix of bgp.networks ?? []) {
+        for (const prefix of bgp.originated_prefixes ?? []) {
             const family = FortiOsNames.familyOfPrefix(prefix);
             const entry = block.block(family === "ipv4" ? "network" : "network6").entry(++networks[family]);
             entry.set(family === "ipv4" ? "prefix" : "prefix6", FortiOsRouting.listPrefix(prefix, family));
@@ -368,30 +377,41 @@ export class FortiOsRouting {
     }
 
     /** The family a rule is limited to, by its match: a family, a prefix, or a prefix set of one family. */
-    static familyOfRule(device: Device, rule: AnyRule): Family | undefined {
-        const match = rule.match;
+    static familyOfRule(device: Device, rule: RouteRule): Family | undefined {
+        const match = rule.if;
         if (match?.family) return match.family;
         if (match?.prefix) return FortiOsNames.familyOfPrefix(match.prefix);
 
-        const set = match?.prefix_set ? device.prefix_sets?.[match.prefix_set] : undefined;
+        const set = match?.prefix_set ? device.routing?.prefix_sets?.[match.prefix_set] : undefined;
         if (set && "source" in set) return set.source.family;
-        if (set?.prefixes[0]) return FortiOsNames.familyOfPrefix(set.prefixes[0]);
+
+        const first = FortiOsRouting.listed(set)?.[0];
+        if (first) return FortiOsNames.familyOfPrefix(first);
 
         return undefined;
     }
 
-    /** A policy's rules with each call replaced by the rules it calls, in order. A called policy that decides nothing hands back to the caller. */
-    static flatten(device: Device, policy: string, seen: string[] = [policy]): AnyRule[] {
-        const flat: AnyRule[] = [];
+    /** A policy's rules with each call replaced by the rules it calls, in order. A called policy that decides nothing hands back to the caller. A `{ communities }` rule, which Circuit writes out before the platform reads it, is left out; `unsupported()` refuses one. */
+    static flatten(device: Device, policy: string, seen: string[] = [policy]): RouteRule[] {
+        const flat: RouteRule[] = [];
 
-        for (const rule of device.policies?.[policy] ?? []) {
-            if (rule.call && !seen.includes(rule.call)) flat.push(...FortiOsRouting.flatten(device, rule.call, [...seen, rule.call]));
-            if (rule.match || rule.set || rule.action) flat.push(rule);
+        for (const rule of device.routing?.policies?.[policy] ?? []) {
+            if ("call" in rule && rule.call !== undefined) {
+                if (!seen.includes(rule.call)) flat.push(...FortiOsRouting.flatten(device, rule.call, [...seen, rule.call]));
+                continue;
+            }
+
+            if (FortiOsRouting.isRouteRule(rule) && (rule.if || rule.set || rule.then)) flat.push(rule);
         }
 
         return flat;
     }
 
+    /** Whether a policy rule is a rule on routes, not a call or a `{ communities }` rule. */
+    static isRouteRule(rule: PolicyRule): rule is RouteRule {
+        return !("call" in rule && rule.call !== undefined) && !("communities" in rule && rule.communities !== undefined);
+    }
+
     /** Routing the platform cannot express, or that this adapter does not yet write. */
     static gaps(device: Device): string[] {
         const found: string[] = [];
@@ -399,9 +419,10 @@ export class FortiOsRouting {
 
         if (routing?.rpki) found.push("routing.rpki, the platform has no route origin validation");
         if (routing?.router_id && !routing.ospf && !routing.bgp) found.push("routing.router_id without OSPF or BGP, which each hold it");
+        if (routing?.bgp && routing.bgp.asn === undefined) found.push("routing.bgp without asn, which the platform's BGP needs");
 
         const ospf = routing?.ospf;
-        if (ospf?.families?.includes("ipv6") && !routing?.router_id) found.push("routing.ospf for IPv6 without routing.router_id");
+        if (ospf?.address_families?.includes("ipv6") && !routing?.router_id) found.push("routing.ospf for IPv6 without routing.router_id");
 
         for (const area of Object.values(ospf?.areas ?? {})) {
             for (const name of Object.keys(area.interfaces)) {
@@ -411,12 +432,14 @@ export class FortiOsRouting {
                 const ipv4 = FortiOsNames.addressesOf(FortiOsNames.settingsOf(device, name)).some(
                     (address) => Address.family(Address.host(address)) === "ipv4"
                 );
-                if ((ospf?.families ?? ["ipv4"]).includes("ipv4") && !ipv4)
+                if ((ospf?.address_families ?? ["ipv4"]).includes("ipv4") && !ipv4)
                     found.push(`routing.ospf on ${name}, which has no IPv4 address for OSPF to run on`);
             }
         }
 
         for (const [name, neighbor] of Object.entries(routing?.bgp?.neighbors ?? {})) {
+            if (!neighbor) continue;
+
             const where = `routing.bgp.neighbors.${name}`;
             const settings = FortiOsRouting.neighborSettings(device, neighbor);
 
@@ -430,27 +453,35 @@ export class FortiOsRouting {
             }
 
             if (Address.family(neighbor.address) === "ipv6" && FortiOsRouting.familiesOfNeighbor(device, neighbor).includes("ipv4")) {
-                found.push(`${where}.families ipv4 over an IPv6 session`);
+                found.push(`${where}.address_families ipv4 over an IPv6 session`);
             }
         }
 
-        for (const [name, rules] of Object.entries(device.policies ?? {})) {
-            rules.forEach((rule, index) => found.push(...FortiOsRouting.ruleGaps(device, `policies.${name}[${index}]`, rule)));
+        for (const [name, rules] of Object.entries(routing?.policies ?? {})) {
+            (rules ?? []).forEach((rule, index) =>
+                found.push(...FortiOsRouting.ruleGaps(device, `routing.policies.${name}[${index}]`, rule))
+            );
         }
 
         return found;
     }
 
-    private static ruleGaps(device: Device, where: string, rule: AnyRule): string[] {
+    private static ruleGaps(device: Device, where: string, rule: PolicyRule): string[] {
+        if (!FortiOsRouting.isRouteRule(rule)) {
+            return "communities" in rule && rule.communities !== undefined
+                ? [`${where}.communities, a rule Circuit writes out as route rules before the platform reads it`]
+                : [];
+        }
+
         const found: string[] = [];
-        const match = rule.match ?? {};
+        const match = rule.if ?? {};
         const set = rule.set ?? {};
 
-        if ((rule.match || rule.set) && !rule.action)
-            found.push(`${where}, a rule without action: the platform stops at the first rule that matches`);
+        if ((rule.if || rule.set) && !rule.then)
+            found.push(`${where}, a rule without then: the platform stops at the first rule that matches`);
 
-        for (const field of ["as_path_length", "through_as", "rpki", "large_community"] as const) {
-            if (match[field] !== undefined) found.push(`${where}.match.${field}`);
+        for (const field of ["as_path_length", "as_path_contains", "rpki", "large_community"] as const) {
+            if (match[field] !== undefined) found.push(`${where}.if.${field}`);
         }
 
         for (const field of [
@@ -463,12 +494,12 @@ export class FortiOsRouting {
             if (set[field] !== undefined) found.push(`${where}.set.${field}`);
         }
 
-        if (match.prefix && match.prefix_length) found.push(`${where}.match.prefix with prefix_length`);
-        if (match.prefix && match.prefix_set) found.push(`${where}.match.prefix with prefix_set`);
+        if (match.prefix && match.prefix_length) found.push(`${where}.if.prefix with prefix_length`);
+        if (match.prefix && match.prefix_set) found.push(`${where}.if.prefix with prefix_set`);
 
-        const prefixSet = match.prefix_set ? device.prefix_sets?.[match.prefix_set] : undefined;
+        const prefixSet = match.prefix_set ? device.routing?.prefix_sets?.[match.prefix_set] : undefined;
         if (prefixSet && "source" in prefixSet && match.prefix_length) {
-            found.push(`${where}.match.prefix_length with a prefix set a registry fills`);
+            found.push(`${where}.if.prefix_length with a prefix set a registry fills`);
         }
 
         return found;

package/src/platforms/fortios/vdoms.ts

@@ -1,7 +1,9 @@
 // Virtual domains: a management VDOM beside `root`. In multi-VDOM mode some sections are the device's own, under `config global`, and the rest belong to one VDOM, under `config vdom` and `edit <name>`. The render and the read write a management VDOM's sections as `@<name> <section>`, so both sides compare like any other section; a plan is made for each scope on its own, and each of its steps sent in that scope.
 
-import type { Device } from "../../schema";
+import type { Device } from "../../model";
+import { Derive } from "../derive";
 import type { Plan, Step } from "../platform";
+import { FortiOsNames } from "./names";
 import { FortiOsBlock, FortiOsTree } from "./tree";
 
 /** Where a section lives in multi-VDOM mode: the device's own, or one VDOM's. */
@@ -49,15 +51,15 @@ export class FortiOsVdoms {
 
     /** The management VDOM's name, when the device has one. */
     static managementOf(device: Device): string | undefined {
-        return device.vdoms?.management.name;
+        return device.system?.vdoms?.management.name;
     }
 
     /** The VDOM a port or interface is in, by Circuit's name. A port in a LAG is where its LAG is. */
     static vdomOf(device: Device, name: string): string {
-        const management = device.vdoms?.management;
+        const management = device.system?.vdoms?.management;
         if (!management) return FortiOsVdoms.ROOT;
 
-        const lag = device.ports?.[name as keyof typeof device.ports]?.lag;
+        const lag = device.interfaces?.ethernet?.[name]?.in_lag;
         const holder = lag ?? name;
         return (management.interfaces as readonly string[]).includes(holder) ? management.name : FortiOsVdoms.ROOT;
     }
@@ -119,7 +121,7 @@ export class FortiOsVdoms {
         }
         if (!wantMulti && haveMulti) {
             return refused(
-                "the device runs several VDOMs and the config has no vdoms. Write vdoms.management, or turn multi-VDOM mode off by hand"
+                "the device runs several VDOMs and the config has no vdoms. Write system.vdoms.management, or turn multi-VDOM mode off by hand"
             );
         }
         if (!wantMulti) return planOne(desired, current);
@@ -187,29 +189,58 @@ export class FortiOsVdoms {
         });
     }
 
+    /** What makes a management VDOM wrong, whatever the platform can express: it is not `root`, it lists a LAG rather than its ports, and each of its routes has a next hop and leaves through one of its interfaces. */
+    static problems(device: Device): string[] {
+        const management = device.system?.vdoms?.management;
+        if (!management) return [];
+
+        const found: string[] = [];
+        const where = "system.vdoms.management";
+
+        if (management.name === FortiOsVdoms.ROOT)
+            found.push(`${where}.name is root, the VDOM everything else is in; give it a name of its own`);
+
+        for (const name of management.interfaces) {
+            const lag = device.interfaces?.ethernet?.[name]?.in_lag;
+            if (lag) found.push(`${where}.interfaces ${name} is in LAG ${lag}; list the LAG`);
+        }
+
+        for (const route of management.static_routes ?? []) {
+            const at = `${where}.static_routes ${route.prefix}`;
+            if (!route.next_hop && !route.interface && !route.blackhole) found.push(`${at} has no next hop`);
+            if (route.interface && !(management.interfaces as readonly string[]).includes(route.interface))
+                found.push(`${at} leaves through ${route.interface}, which is not in the VDOM`);
+        }
+
+        return found;
+    }
+
     /** What a management VDOM can't hold yet, or a config with one can't have. */
+
     static gaps(device: Device): string[] {
-        if (!device.vdoms) return [];
+        const management = device.system?.vdoms?.management;
+        if (!management) return [];
 
         const found: string[] = [];
-        const tunnels = Object.entries(device.interfaces ?? {}).filter(([, iface]) => iface.type === "gre" || iface.type === "vxlan");
+        const tunnels = FortiOsNames.interfacesOf(device).filter(({ kind }) => kind === "gre" || kind === "vxlan");
         if (tunnels.length)
-            found.push(`vdoms with GRE or VXLAN tunnels (${tunnels.map(([name]) => name).join(", ")}), whose tables belong to a VDOM`);
-        if (Object.values(device.interfaces ?? {}).some((iface) => iface.type === "bridge"))
-            found.push("vdoms with a bridge, which needs transparent mode");
+            found.push(
+                `system.vdoms with GRE or VXLAN tunnels (${tunnels.map(({ name }) => name).join(", ")}), whose tables belong to a VDOM`
+            );
+        if (FortiOsNames.isTransparent(device)) found.push("system.vdoms with a bridge, which needs transparent mode");
 
-        const management = device.vdoms.management;
         const inManagement = (name: string | undefined) =>
             name !== undefined && (management.interfaces as readonly string[]).includes(name);
 
-        for (const route of device.routing?.static ?? []) {
+        for (const route of device.routing?.static_routes ?? []) {
             if (inManagement(route.interface))
-                found.push(`routing.static ${route.prefix} leaves through ${route.interface}, in vdoms.management; write it there`);
+                found.push(
+                    `routing.static_routes ${route.prefix} leaves through ${route.interface}, in system.vdoms.management; write it in its static_routes`
+                );
         }
         for (const name of management.interfaces) {
-            const settings =
-                device.interfaces?.[name as keyof typeof device.interfaces] ?? device.ports?.[name as keyof typeof device.ports];
-            if (settings && "vrf" in settings && settings.vrf) found.push(`vdoms.management interface ${name} in VRF ${settings.vrf}`);
+            const vrf = Derive.settings(device, name)?.vrf;
+            if (vrf) found.push(`system.vdoms.management interface ${name} in VRF ${vrf}`);
         }
 
         return found;

package/src/platforms/junos/TRAPS.md

@@ -22,7 +22,7 @@ Behaviour that looks like something else. Each one has been hit on a QFX5100-48S
 - The factory VLAN `default` can be deleted.
 - BGP without a licence commits with only a warning, `requires 'bgp' license`, and sessions establish. The same is true for the other licensed features.
 - Junos accepts and announces every route over eBGP unless a policy says otherwise: `Default eBGP mode: advertise - accept, receive - accept`. A session without a policy is given `circuit-reject-all`.
-- An export policy sees every active route, not only BGP's. Every export starts with `circuit-bgp-origin`, which passes on BGP's routes and the prefixes in `routing.bgp.networks` and rejects the rest.
+- An export policy sees every active route, not only BGP's. Every export starts with `circuit-bgp-origin`, which passes on BGP's routes and the prefixes in `routing.bgp.originated_prefixes` and rejects the rest.
 - A policy's or a filter's terms are kept in order, and `set` adds a new term at the end. A change to one rewrites it whole.
 - One policy term cannot filter IPv4 and IPv6 prefixes together: `invalid prefix ::/0 for family inet`. A rule for both families becomes a term for each.
 - A port filter cannot match the VLAN a frame is switched in: `learn-vlan-id not supported on ingress interface`.
@@ -38,5 +38,5 @@ Behaviour that looks like something else. Each one has been hit on a QFX5100-48S
 - A static route with BFD is withdrawn while its next hop does not answer BFD, so `show route` shows nothing for it. A session that is down sends every 2 seconds, `Transmit Interval 2.000`, whatever the interval.
 - `bfd-liveness-detection` on a static route also watches a `qualified-next-hop`: a session to that address starts.
 - `set switch-options interface xe-0/0/1 interface-mac-limit 1 packet-action drop` is stored on the logical interface and in two statements: `... interface xe-0/0/1.0 interface-mac-limit 1` and `... interface-mac-limit packet-action drop`. The render writes those two.
-- An `ethernet-switching` filter takes `from ether-type ipv4`, `ipv6` and `arp` by name. Ethertypes and an `acl` would both be the port's `filter input`, so Circuit refuses the two on one port rather than merge them.
+- An `ethernet-switching` filter takes `from ether-type ipv4`, `ipv6` and `arp` by name. Ethertypes and an `ingress_acl` would both be the port's `filter input`, so Circuit refuses the two on one port rather than merge them.
 - LLDP sends a port's SNMP index as its port ID, `PortIdSubtype: local`, `PortId: 520`, so a neighbor cannot tell which port it is. `set protocols lldp port-id-subtype interface-name` makes it send `et-0/0/52`, and the render sets it wherever LLDP runs.