@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/src/platforms/junos/index.ts

@@ -6,7 +6,7 @@ import type { Client, ClientChannel } from "ssh2";
 import { Address } from "../../core/address";
 import type { Neighbor } from "../../core/cabling";
 import { Secrets } from "../../core/secrets";
-import type { Device, Family, IP } from "../../schema";
+import type { Device, Family, Lag, Port, Routed } from "../../model";
 import { ConsoleShell, SerialConsole, type ConsoleDialect } from "../../transport/console";
 import { Ssh } from "../../transport/ssh";
 import { Catalog } from "../catalog";
@@ -127,26 +127,29 @@ export class Junos extends Platform {
 
     unsupported(device: Device): string[] {
         const found: string[] = [];
+        const interfaces = Derive.interfaces(device);
 
-        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-            if (iface.type === "bridge") found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
-            if (iface.type === "vlan" && iface.mac) found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
+        for (const { name, kind } of interfaces) {
+            if (kind === "bridge") found.push(`interfaces.bridge.${name}, a bridge, which only FortiOS builds for now`);
+            if (kind === "vlan_interface" && device.interfaces?.vlan_interface?.[name]?.mac)
+                found.push(`interfaces.vlan_interface.${name}.mac, which only RouterOS sets for now`);
         }
         const names = new JunosNames(device);
-        const users = device.users ?? {};
+        const users = device.system?.users ?? {};
 
-        const root = (users as Record<string, (typeof users)[keyof typeof users]>).root;
-        if (!root) found.push("users without root, the platform needs a root password");
-        if (root && root.role !== "admin") found.push("users.root.role, root is always admin");
-        if (root?.description) found.push("users.root.description");
+        const root = users.root;
+        if (!root) found.push("system.users without root, the platform needs a root password");
+        if (root && root.role !== "admin") found.push("system.users.root.role, root is always admin");
+        if (root?.description) found.push("system.users.root.description");
         if (device.connection.user === "root") found.push("connection.user root, which logs in to a shell rather than the CLI");
 
         for (const [name, user] of Object.entries(users)) {
-            if (Junos.SYSTEM_ACCOUNTS.has(name)) found.push(`users.${name}, a name the platform keeps for a system account`);
+            if (!user) continue;
+            if (Junos.SYSTEM_ACCOUNTS.has(name)) found.push(`system.users.${name}, a name the platform keeps for a system account`);
 
             for (const key of user.ssh_keys ?? []) {
                 const kind = key.split(" ")[0]!;
-                if (!JunosRender.KEY_STATEMENT[kind]) found.push(`users.${name}.ssh_keys, a key of type ${kind}`);
+                if (!JunosRender.KEY_STATEMENT[kind]) found.push(`system.users.${name}.ssh_keys, a key of type ${kind}`);
             }
         }
 
@@ -158,29 +161,28 @@ export class Junos extends Platform {
 
         if (management.console) found.push("management.console, the console uses the device's users");
         if (management.interfaces) found.push("management.interfaces, which only FortiOS builds for now");
-        if (management.native?.interfaces?.length) found.push("management.native.interfaces, NETCONF runs over IP only");
+        if (management.native_protocol?.interfaces?.length) found.push("management.native_protocol.interfaces, NETCONF runs over IP only");
         if (management.ssh?.auth_timeout || management.ssh?.auth_retries) found.push("management.ssh.auth_timeout and auth_retries");
 
-        for (const service of ["telnet", "ftp", "snmp"] as const) {
-            if (management[service]?.port) found.push(`management.${service}.port`);
-        }
+        if (management.telnet?.port) found.push("management.telnet.port");
+        if (management.ftp?.port) found.push("management.ftp.port");
+        if (device.monitoring?.snmp?.port) found.push("monitoring.snmp.port");
 
         const system = device.system ?? {};
 
         if (system.release_channel) found.push("system.release_channel");
-        if (system.transceiver_monitoring !== undefined) found.push("system.transceiver_monitoring, it is always on");
-        if (system.dns?.serve) found.push("system.dns.serve");
-        if (system.ip?.syn_cookies) found.push("system.ip.syn_cookies");
+        if (device.monitoring?.transceivers !== undefined) found.push("monitoring.transceivers, it is always on");
+        if (device.services?.dns_server) found.push("services.dns_server");
+        if (system.ip_stack?.syn_cookies) found.push("system.ip_stack.syn_cookies");
         if (system.logging?.local?.lines_per_file !== undefined) found.push("system.logging.local.lines_per_file, files rotate by size");
 
         // Time is answered only to its servers, which the filter names by address.
-        if (system.ntp && !system.ntp.serve && system.ntp.servers.some((server) => !Address.isValid(server))) {
-            found.push("system.ntp.servers by name while not serving, the filter keeping others out needs addresses");
+        if (system.ntp && !device.services?.ntp_server && system.ntp.servers.some((server) => !Address.isValid(server))) {
+            found.push("system.ntp.servers by name without services.ntp_server, the filter keeping others out needs addresses");
         }
 
-        for (const [name, port] of Object.entries(device.ports ?? {})) {
-            if (!port) continue;
-
+        for (const [name, port] of Derive.ports(device)) {
+            const where = `interfaces.ethernet.${name}`;
             const physical = names.port(name);
 
             if (physical.startsWith("em")) {
@@ -188,119 +190,135 @@ export class Junos extends Platform {
                     "access_vlan",
                     "trunk_vlans",
                     "native_vlan",
-                    "lag",
+                    "in_lag",
                     "stp",
                     "storm_control",
                     "speed",
                     "vrrp",
                     "vrf",
                     "mtu",
-                    "acl",
+                    "ingress_acl",
                     "ipv6_ra",
                 ] as const) {
-                    if (port[field] !== undefined) found.push(`ports.${name}.${field}, a management port only routes`);
+                    if (port[field] !== undefined) found.push(`${where}.${field}, a management port only routes`);
                 }
             }
 
             if (port.speed && !(port.speed === "1g" && physical.startsWith("ge-")))
-                found.push(`ports.${name}.speed ${port.speed}, only a 1G optic in a 10G cage`);
+                found.push(`${where}.speed ${port.speed}, only a 1G optic in a 10G cage`);
 
-            if (port.hardware_offload !== undefined) found.push(`ports.${name}.hardware_offload`);
+            if (port.hardware_offload !== undefined) found.push(`${where}.hardware_offload`);
 
             // A port filter cannot match the VLAN a frame is switched in: `learn-vlan-id` is refused on an ingress port.
-            const acl = port.acl ? device.acls?.[port.acl] : undefined;
-            if (acl?.some((rule) => rule.match?.vlan)) found.push(`acls.${port.acl} matching a VLAN, on port ${name}`);
+            const acl = port.ingress_acl ? device.switching?.acls?.[port.ingress_acl] : undefined;
+            if (acl?.some((rule) => rule.if?.vlan)) found.push(`switching.acls.${port.ingress_acl} matching a VLAN, on port ${name}`);
 
-            found.push(...Junos.routedGaps(`ports.${name}`, port));
-            found.push(...Junos.switchedGaps(`ports.${name}`, port, device));
+            found.push(...Junos.routedGaps(where, port));
+            found.push(...Junos.switchedGaps(where, port, device));
+        }
+
+        // A rule's match takes one address and one VLAN here; a list is one rule per value.
+        for (const [name, rules] of Object.entries(device.switching?.acls ?? {})) {
+            (rules ?? []).forEach((rule, index) => {
+                for (const field of ["src", "dst", "vlan"] as const) {
+                    if (Array.isArray(rule.if?.[field]))
+                        found.push(`switching.acls.${name}[${index}].if.${field}, a list: write one rule for each`);
+                }
+            });
         }
 
         const loopbackTables = new Set<string>();
 
-        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-            if (iface.type === "vxlan" || iface.type === "wireguard") {
-                found.push(`interfaces.${name}, a ${iface.type}`);
+        for (const { name, kind, settings } of interfaces) {
+            const where = `interfaces.${kind}.${name}`;
+
+            if (kind === "vxlan" || kind === "wireguard") {
+                found.push(`${where}, a ${kind}`);
                 continue;
             }
 
-            if (iface.hardware_offload !== undefined) found.push(`interfaces.${name}.hardware_offload`);
-            if (iface.type === "loopback" && iface.ipv6_ra) found.push(`interfaces.${name}.ipv6_ra, on a loopback`);
-            if (iface.type === "loopback" && iface.mtu !== undefined) found.push(`interfaces.${name}.mtu, on a loopback`);
-            if (iface.type === "gre" && iface.vrrp?.length) found.push(`interfaces.${name}.vrrp, on a tunnel`);
+            if (settings.hardware_offload !== undefined) found.push(`${where}.hardware_offload`);
+            if (kind === "loopback" && settings.ipv6_ra) found.push(`${where}.ipv6_ra, on a loopback`);
+            if (kind === "loopback" && settings.mtu !== undefined) found.push(`${where}.mtu, on a loopback`);
+            if (kind === "gre" && settings.vrrp?.length) found.push(`${where}.vrrp, on a tunnel`);
 
             // A VLAN interface sends no larger packets than the ports carrying its VLAN take; the device warns and carries on.
-            if (iface.type === "vlan" && iface.mtu !== undefined) {
-                const smallest = Math.min(...Junos.carriers(device, iface.vlan));
-                if (iface.mtu > smallest) found.push(`interfaces.${name}.mtu ${iface.mtu}, above the ${smallest} its VLAN's ports carry`);
+            const vlanInterface = kind === "vlan_interface" ? device.interfaces?.vlan_interface?.[name] : undefined;
+            if (vlanInterface?.mtu !== undefined) {
+                const smallest = Math.min(...Junos.carriers(device, vlanInterface.vlan));
+                if (vlanInterface.mtu > smallest)
+                    found.push(`${where}.mtu ${vlanInterface.mtu}, above the ${smallest} its VLAN's ports carry`);
             }
 
-            found.push(...Junos.routedGaps(`interfaces.${name}`, iface));
+            found.push(...Junos.routedGaps(where, settings));
 
-            if (iface.type === "lag") found.push(...Junos.switchedGaps(`interfaces.${name}`, iface, device));
+            const lag = kind === "lag" ? device.interfaces?.lag?.[name] : undefined;
+            if (lag) found.push(...Junos.switchedGaps(where, lag, device));
 
-            if (iface.type === "loopback") {
-                const table = iface.vrf ?? "";
-                if (loopbackTables.has(table)) found.push(`interfaces.${name}, a second loopback in one routing table`);
+            if (kind === "loopback") {
+                const table = settings.vrf ?? "";
+                if (loopbackTables.has(table)) found.push(`${where}, a second loopback in one routing table`);
                 loopbackTables.add(table);
-                if (iface.vrrp?.length) found.push(`interfaces.${name}.vrrp, on a loopback`);
+                if (settings.vrrp?.length) found.push(`${where}.vrrp, on a loopback`);
             }
         }
 
         const ids = [...Derive.lagIds(device).values()];
-        if (ids.length !== new Set(ids).size) found.push("interfaces, two LAGs with one number");
+        if (ids.length !== new Set(ids).size) found.push("interfaces.lag, two LAGs with one number");
 
-        if (device.stp?.priority !== undefined && device.stp.priority % 4096 !== 0) found.push("stp.priority, in steps of 4096");
+        const stp = device.switching?.stp;
+        if (stp?.priority !== undefined && stp.priority % 4096 !== 0) found.push("switching.stp.priority, in steps of 4096");
 
         const routing = device.routing;
         found.push(...Junos.bgpGaps(device));
 
         const tables = new Map<string, number>();
 
-        for (const route of routing?.static ?? []) {
-            if (route.description) found.push(`routing.static ${route.prefix} description`);
+        for (const route of routing?.static_routes ?? []) {
+            if (route.description) found.push(`routing.static_routes ${route.prefix} description`);
 
             const table = `${route.vrf ?? ""} ${Address.split(route.prefix).addr}/${Address.split(route.prefix).len}`;
             tables.set(table, (tables.get(table) ?? 0) + 1);
         }
 
-        for (const route of routing?.static ?? []) {
+        for (const route of routing?.static_routes ?? []) {
             const table = `${route.vrf ?? ""} ${Address.split(route.prefix).addr}/${Address.split(route.prefix).len}`;
             if (route.blackhole && tables.get(table)! > 1)
-                found.push(`routing.static ${route.prefix}, a blackhole beside another route to the same prefix`);
+                found.push(`routing.static_routes ${route.prefix}, a blackhole beside another route to the same prefix`);
         }
 
         for (const area of Object.values(routing?.ospf?.areas ?? {})) {
-            for (const iface of Object.keys(area.interfaces)) {
-                const settings = device.interfaces?.[iface] ?? device.ports?.[iface as keyof typeof device.ports];
-                if (settings?.vrf) found.push(`routing.ospf on ${iface}, which routes in a VRF`);
+            for (const [iface, settings] of Object.entries(area.interfaces)) {
+                if (settings && Derive.settings(device, iface)?.vrf) found.push(`routing.ospf on ${iface}, which routes in a VRF`);
             }
         }
 
-        for (const field of ["firewall", "hardware_offload", "certificates"] as const) {
-            if (device[field] !== undefined) found.push(field);
-        }
+        if (device.firewall !== undefined) found.push("firewall");
+        if (system.hardware_offload !== undefined) found.push("system.hardware_offload");
+        if (system.certificates !== undefined) found.push("system.certificates");
 
-        const relayed = new Set(Object.values(device.dhcp_relay ?? {}).map((relay) => relay.interface));
+        const services = device.services ?? {};
+        const relayed = new Set(Object.values(services.dhcp_relay ?? {}).map((relay) => relay.interface));
 
-        for (const [name, server] of Object.entries(device.dhcp ?? {})) {
+        for (const [name, server] of Object.entries(services.dhcp_server ?? {})) {
             // The device refuses a relay and a server on one interface: `Interface irb.10 already configured`.
-            if (relayed.has(server.interface)) found.push(`dhcp.${name}.interface, which a DHCP relay also uses`);
+            if (relayed.has(server.interface)) found.push(`services.dhcp_server.${name}.interface, which a DHCP relay also uses`);
 
-            const settings = device.interfaces?.[server.interface] ?? device.ports?.[server.interface as keyof typeof device.ports];
-            if (settings?.vrf) found.push(`dhcp.${name}.interface, which routes in a VRF`);
-            if (Address.family(Address.host(server.network)) === "ipv6") found.push(`dhcp.${name}.network, IPv6`);
+            if (Derive.settings(device, server.interface)?.vrf) found.push(`services.dhcp_server.${name}.interface, which routes in a VRF`);
+            if (Address.family(Address.host(server.network)) === "ipv6") found.push(`services.dhcp_server.${name}.network, IPv6`);
         }
 
-        for (const [name, relay] of Object.entries(device.dhcp_relay ?? {})) {
-            if (relay.servers.some((server) => Address.family(server) === "ipv6")) found.push(`dhcp_relay.${name}.servers, IPv6`);
+        for (const [name, relay] of Object.entries(services.dhcp_relay ?? {})) {
+            if (relay.servers.some((server) => Address.family(server) === "ipv6")) found.push(`services.dhcp_relay.${name}.servers, IPv6`);
         }
 
-        const flow = device.flow_export;
-        if (flow && flow.protocol !== "sflow") found.push(`flow_export.protocol ${flow.protocol}, the platform exports sFlow`);
-        if (flow?.protocol === "sflow" && flow.sampling === undefined) found.push("flow_export.sampling, the platform samples");
+        const flow = device.monitoring?.flow_export;
+        if (flow && flow.protocol !== "sflow") found.push(`monitoring.flow_export.protocol ${flow.protocol}, the platform exports sFlow`);
+        if (flow?.protocol === "sflow" && flow.sampling === undefined) found.push("monitoring.flow_export.sampling, the platform samples");
 
         for (const name of flow?.interfaces ?? []) {
-            if (names.members(name).some((port) => port.startsWith("em"))) found.push(`flow_export.interfaces ${name}, a management port`);
+            if (names.members(name).some((port) => port.startsWith("em")))
+                found.push(`monitoring.flow_export.interfaces ${name}, a management port`);
         }
 
         found.push(...Derive.unproved(device, Junos.PROVED));
@@ -749,7 +767,7 @@ export class Junos extends Platform {
 
         // The CLI is opened on a prompt asked for after the login, since the login's own prompt is already read.
         const login = async () => {
-            await SerialConsole.login(opened.channel, Junos.CONSOLE, user, password, console.passwordOnly);
+            await SerialConsole.login(opened.channel, Junos.CONSOLE, user, password, console.password_only);
             const ready = Junos.openCli(opened.channel);
             opened.channel.write("\n");
             await ready;
@@ -912,7 +930,10 @@ export class Junos extends Platform {
     /** The IP MTU of every port and LAG that carries a VLAN; 1500 where none is given. */
     private static carriers(device: Device, vlan: string): number[] {
         const sizes = [1500];
-        const carrying = [...Object.values(device.ports ?? {}), ...Object.values(device.interfaces ?? {})];
+        const carrying: (Port | Lag | undefined)[] = [
+            ...Derive.ports(device).map(([, settings]) => settings),
+            ...Object.values(device.interfaces?.lag ?? {}),
+        ];
 
         for (const settings of carrying) {
             if (!settings || !("access_vlan" in settings || "trunk_vlans" in settings)) continue;
@@ -929,12 +950,16 @@ export class Junos extends Platform {
         const found: string[] = [];
         const bgp = device.routing?.bgp;
 
+        if (bgp && bgp.asn === undefined) found.push("routing.bgp.asn, absent: write it here or in circuit.ts");
+
         for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
+            if (!neighbor) continue;
+
             const settings = JunosBgp.settingsOf(device, neighbor);
             if (settings.role) found.push(`routing.bgp.neighbors.${name}.role, Junos 21 has no BGP roles`);
             // IPv4 routes over an IPv6 session need a local IPv4 address the config has no field for.
-            if (Address.family(neighbor.address) === "ipv6" && settings.families?.includes("ipv4")) {
-                found.push(`routing.bgp.neighbors.${name}.families ipv4 over an IPv6 session`);
+            if (Address.family(neighbor.address) === "ipv6" && settings.address_families?.includes("ipv4")) {
+                found.push(`routing.bgp.neighbors.${name}.address_families ipv4 over an IPv6 session`);
             }
 
             if (settings.keepalive !== undefined)
@@ -945,22 +970,30 @@ export class Junos extends Platform {
             if (server.description) found.push(`routing.rpki ${server.address} description`);
         }
 
-        for (const [name, rules] of Object.entries(device.policies ?? {})) {
-            rules.forEach((rule, index) => {
-                const where = `policies.${name}[${index}]`;
+        for (const [name, rules] of Object.entries(device.routing?.policies ?? {})) {
+            (rules ?? []).forEach((rule, index) => {
+                const where = `routing.policies.${name}[${index}]`;
+                if ("communities" in rule && rule.communities !== undefined)
+                    found.push(`${where}.communities, a rule the platform does not write`);
+                if (!JunosBgp.isRouteRule(rule)) return;
+
                 if (rule.set?.preferred_source) found.push(`${where}.set.preferred_source`);
-                if (rule.match?.prefix && rule.match.prefix_length) found.push(`${where}.match.prefix with prefix_length`);
+                if (rule.if?.prefix && rule.if.prefix_length) found.push(`${where}.if.prefix with prefix_length`);
             });
         }
 
+        // A rule takes its family from its prefix set, so a set holds one.
+        for (const [name, set] of Object.entries(device.routing?.prefix_sets ?? {})) {
+            const families = new Set(JunosBgp.prefixesOf(set ?? { prefixes: [] }).map((prefix) => Address.family(Address.host(prefix))));
+            if (families.size > 1)
+                found.push(`routing.prefix_sets.${name}.prefixes of both families, a policy rule takes its family from them`);
+        }
+
         return found;
     }
 
     /** Layer 3 settings the platform cannot express on a port or an interface. */
-    private static routedGaps(
-        where: string,
-        settings: { addresses?: readonly (string | { address: string; peer: string })[]; vrrp?: readonly { id: number; address: IP }[] }
-    ): string[] {
+    private static routedGaps(where: string, settings: Pick<Routed, "addresses" | "vrrp">): string[] {
         const found: string[] = [];
         const addresses = (settings.addresses ?? []).map((entry) => (typeof entry === "string" ? entry : entry.address));
 
@@ -985,11 +1018,11 @@ export class Junos extends Platform {
             found.push(`${where}.storm_control, one threshold for every kind`);
         }
 
-        if (typeof settings.stp === "object" && !device.stp) found.push(`${where}.stp while spanning tree is off on the device`);
+        if (typeof settings.stp === "object" && !device.switching?.stp) found.push(`${where}.stp while spanning tree is off on the device`);
 
-        // The limit and the filter sit on the switching family. The filter and an acl would both be its input filter.
+        // The limit and the filter sit on the switching family. The filter and an ACL would both be its input filter.
         const switched = settings.access_vlan || settings.trunk_vlans;
-        const inLag = "lag" in settings && settings.lag;
+        const inLag = "in_lag" in settings && settings.in_lag;
 
         for (const field of ["mac_limit", "ethertypes"] as const) {
             if (settings[field] === undefined) continue;
@@ -998,8 +1031,8 @@ export class Junos extends Platform {
             else if (!switched) found.push(`${where}.${field}, on a port or LAG that switches no VLAN`);
         }
 
-        if (settings.ethertypes && "acl" in settings && settings.acl)
-            found.push(`${where}.ethertypes with an acl, the port takes one filter`);
+        if (settings.ethertypes && "ingress_acl" in settings && settings.ingress_acl)
+            found.push(`${where}.ethertypes with an ingress_acl, the port takes one filter`);
 
         return found;
     }