@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/src/platforms/junos/render.ts

@@ -3,16 +3,13 @@
 import { Address } from "../../core/address";
 import { Cabling } from "../../core/cabling";
 import { Secrets } from "../../core/secrets";
-import type { AclRule, Device, Ethertype, Family, Interface, Port, Ports, Rate, Severity, Vrrp } from "../../schema";
+import type { AclRule, Device, Ethertype, Family, Interface, Lag, Port, Ports, Rate, Severity, Vrrp } from "../../model";
 import { Catalog } from "../catalog";
 import { Derive } from "../derive";
 import { JunosBgp } from "./bgp";
 
-type AnyPort = Port<string, string, string, string>;
-type AnyInterface = Interface<string, string>;
-type LagInterface = Extract<AnyInterface, { type: "lag" }>;
-type Switched = AnyPort | LagInterface;
-type AnyAclRule = AclRule<string>;
+/** A port or a LAG: what switches VLANs. */
+type Switched = Port | Lag;
 
 /** Collects `set` statements, and comments the plan reads. */
 export class JunosStatements {
@@ -51,49 +48,49 @@ export class JunosNames {
         this.lags = Derive.lagIds(device);
 
         // The default table's loopback is unit 0; one in a VRF takes the next unit.
-        const loopbacks = Object.entries(device.interfaces ?? {}).filter(([, iface]) => iface.type === "loopback");
+        const loopbacks = Derive.interfaces(device).filter((entry) => entry.kind === "loopback");
         let unit = 0;
 
-        for (const [name, iface] of loopbacks) if (!iface.vrf) this.loopbacks.set(name, 0);
+        for (const { name, settings } of loopbacks) if (!settings.vrf) this.loopbacks.set(name, 0);
 
-        for (const [name, iface] of loopbacks) if (iface.vrf) this.loopbacks.set(name, ++unit);
+        for (const { name, settings } of loopbacks) if (settings.vrf) this.loopbacks.set(name, ++unit);
 
         // GRE tunnels are units of the one tunnel interface, in order.
-        const tunnels = Object.entries(device.interfaces ?? {}).filter(([, iface]) => iface.type === "gre");
-        tunnels.forEach(([name], index) => this.tunnels.set(name, index));
+        const tunnels = Derive.interfaces(device).filter((entry) => entry.kind === "gre");
+        tunnels.forEach(({ name }, index) => this.tunnels.set(name, index));
     }
 
     /** A physical port. A 10G cage holding a 1G optic is `ge-`, not `xe-`. */
     port(port: string): string {
         const name = Catalog.spell(this.device.platform, this.device.model, port);
-        const settings = this.device.ports?.[port as keyof typeof this.device.ports];
+        const settings = this.device.interfaces?.ethernet?.[port];
         return settings?.speed === "1g" ? name.replace(/^xe-/, "ge-") : name;
     }
 
     /** The physical interface a port or a LAG is: `xe-0/0/1`, `ae1`. */
     physical(name: string): string {
-        if (this.device.interfaces?.[name]?.type === "lag") return `ae${this.lags.get(name)}`;
+        if (this.device.interfaces?.lag?.[name]) return `ae${this.lags.get(name)}`;
 
         return this.port(name);
     }
 
     /** The logical interface that holds addresses: `xe-0/0/1.0`, `ae1.0`, `irb.10`, `lo0.0`. */
     unit(name: string): string {
-        const iface = this.device.interfaces?.[name];
-        if (iface?.type === "vlan") return `irb.${this.device.vlans![iface.vlan]!.id}`;
+        const vlanInterface = this.device.interfaces?.vlan_interface?.[name];
+        if (vlanInterface) return `irb.${this.device.switching!.vlans![vlanInterface.vlan]!.id}`;
 
-        if (iface?.type === "loopback") return `lo0.${this.loopbacks.get(name)}`;
+        if (this.device.interfaces?.loopback?.[name]) return `lo0.${this.loopbacks.get(name)}`;
 
-        if (iface?.type === "gre") return `gr-0/0/0.${this.tunnels.get(name)}`;
+        if (this.device.interfaces?.gre?.[name]) return `gr-0/0/0.${this.tunnels.get(name)}`;
 
         return `${this.physical(name)}.0`;
     }
 
     /** The physical ports behind a port or a LAG. */
     members(name: string): string[] {
-        if (this.device.interfaces?.[name]?.type !== "lag") return [this.port(name)];
+        if (!this.device.interfaces?.lag?.[name]) return [this.port(name)];
 
-        const ports = Object.entries(this.device.ports ?? {}).filter(([, settings]) => settings?.lag === name);
+        const ports = Derive.ports(this.device).filter(([, settings]) => settings.in_lag === name);
         return ports.map(([port]) => this.port(port));
     }
 }
@@ -147,7 +144,7 @@ export class JunosRender {
         "group-exchange-sha2",
     ];
 
-    /** The transport and port each management service listens on. */
+    /** The transport and port each management service listens on, by the name of its term in the services filter. */
     private static readonly SERVICE_PORTS = {
         ssh: ["tcp", 22],
         telnet: ["tcp", 23],
@@ -267,14 +264,19 @@ export class JunosRender {
     }
 
     /** The family a hardware ACL rule is limited to, by its family or its addresses. */
-    private static aclFamily(rule: AnyAclRule): Family | undefined {
-        const match = rule.match;
+    private static aclFamily(rule: AclRule): Family | undefined {
+        const match = rule.if;
         if (match?.family) return match.family;
 
-        const address = match?.src ?? match?.dst;
+        const address = JunosRender.each(match?.src ?? match?.dst)[0];
         return address ? Address.family(Address.host(address)) : undefined;
     }
 
+    /** One value or a list of them, as a list. `unsupported()` refuses a list in an ACL rule's match, so a rule rendered for a device has one. */
+    private static each<T extends string>(value: T | readonly T[] | undefined): T[] {
+        return value === undefined ? [] : ([value].flat() as T[]);
+    }
+
     /** The protocol as an IPv6 header names it. */
     private static nextHeader(protocol: string): string {
         return protocol === "icmp" ? "icmp6" : protocol;
@@ -297,7 +299,7 @@ export class JunosRender {
         for (const server of system.ntp?.servers ?? []) this.out.set("system ntp server", server);
 
         // Redirects are sent unless turned off, for each family.
-        if (!system.ip?.icmp_redirects) {
+        if (!system.ip_stack?.icmp_redirects) {
             this.out.set("system no-redirects");
             this.out.set("system no-redirects-ipv6");
         }
@@ -308,7 +310,7 @@ export class JunosRender {
             if (local.files !== undefined) this.out.set("system syslog file messages archive files", local.files);
         }
 
-        for (const remote of system.logging?.remote ?? []) {
+        for (const remote of this.device.monitoring?.syslog ?? []) {
             this.out.set("system syslog host", remote.address, "any", JunosRender.LEVEL[remote.level]);
             if (remote.port !== undefined && remote.port !== 514) this.out.set("system syslog host", remote.address, "port", remote.port);
         }
@@ -316,7 +318,9 @@ export class JunosRender {
 
     /** Every user but root logs in with a class. Root is the platform's own account and takes only its password and keys. */
     private users(): void {
-        for (const [name, user] of Object.entries(this.device.users ?? {})) {
+        for (const [name, user] of Object.entries(this.device.system?.users ?? {})) {
+            if (!user) continue;
+
             const login = name === "root" ? "system root-authentication" : `system login user ${name} authentication`;
 
             if (name !== "root") {
@@ -357,7 +361,7 @@ export class JunosRender {
         ] as const;
 
         for (const [service, statement] of others) {
-            const settings = management[service];
+            const settings = this.serviceSettings(service);
             if (!settings) continue;
 
             this.out.set(statement);
@@ -366,9 +370,17 @@ export class JunosRender {
         }
     }
 
+    /** A service's settings, by the name of its term in the services filter: SNMP is `monitoring.snmp`, NETCONF `management.native_protocol`. */
+    private serviceSettings(service: keyof typeof JunosRender.SERVICE_PORTS): { allow?: readonly string[]; port?: number } | undefined {
+        if (service === "snmp") return this.device.monitoring?.snmp;
+        if (service === "native") return this.device.management?.native_protocol;
+
+        return this.device.management?.[service];
+    }
+
     /** SNMP version 2c with one read community, version 3 with users in one read-only group, or both. */
     private snmp(): void {
-        const snmp = this.device.management?.snmp;
+        const snmp = this.device.monitoring?.snmp;
         if (!snmp) return;
 
         if (snmp.contact) this.out.set("snmp contact", JunosRender.quote(snmp.contact));
@@ -391,13 +403,15 @@ export class JunosRender {
     }
 
     private vlans(): void {
-        for (const [name, vlan] of Object.entries(this.device.vlans ?? {})) {
+        for (const [name, vlan] of Object.entries(this.device.switching?.vlans ?? {})) {
+            if (!vlan) continue;
+
             this.out.set(`vlans ${name} vlan-id`, vlan.id);
             if (vlan.description) this.out.set(`vlans ${name} description`, JunosRender.quote(vlan.description));
         }
 
-        for (const [name, iface] of Object.entries(this.device.interfaces ?? {})) {
-            if (iface.type === "vlan") this.out.set(`vlans ${iface.vlan} l3-interface`, this.names.unit(name));
+        for (const [name, iface] of Object.entries(this.device.interfaces?.vlan_interface ?? {})) {
+            if (iface) this.out.set(`vlans ${iface.vlan} l3-interface`, this.names.unit(name));
         }
     }
 
@@ -416,7 +430,8 @@ export class JunosRender {
             const members = new Set([...settings.trunk_vlans, ...(settings.native_vlan ? [settings.native_vlan] : [])]);
             for (const vlan of members) this.out.set(family, "vlan members", vlan);
 
-            if (settings.native_vlan) this.out.set(`interfaces ${physical} native-vlan-id`, this.device.vlans![settings.native_vlan]!.id);
+            if (settings.native_vlan)
+                this.out.set(`interfaces ${physical} native-vlan-id`, this.device.switching!.vlans![settings.native_vlan]!.id);
         }
 
         const storm = JunosRender.stormProfile(settings);
@@ -439,10 +454,13 @@ export class JunosRender {
 
     /** One filter for each set of kinds a port or LAG lets in: those kinds, then nothing else. */
     private ethertypeFilters(): void {
-        const holders = [...Object.values(this.device.ports ?? {}), ...Object.values(this.device.interfaces ?? {})];
+        const holders: Switched[] = [
+            ...Derive.ports(this.device).map(([, settings]) => settings),
+            ...this.lagSettings().map(([, lag]) => lag),
+        ];
 
         for (const settings of holders) {
-            if (!settings || !("ethertypes" in settings) || !settings.ethertypes) continue;
+            if (!settings.ethertypes) continue;
 
             const filter = `firewall family ethernet-switching filter ${JunosRender.ethertypeFilter(settings.ethertypes)}`;
             for (const kind of JunosRender.ETHERTYPES.filter((kind) => settings.ethertypes!.includes(kind)))
@@ -453,7 +471,7 @@ export class JunosRender {
     }
 
     /** Addresses and VRRP groups of a logical interface such as `irb.10`. */
-    private addressing(unit: string, settings: AnyPort | AnyInterface): void {
+    private addressing(unit: string, settings: Port | Interface): void {
         const [physical, number] = unit.split(".");
         const prefix = `interfaces ${physical} unit ${number}`;
         const addresses = (settings.addresses ?? []).map((entry) => (typeof entry === "string" ? entry : entry.address));
@@ -477,7 +495,7 @@ export class JunosRender {
     /** Every port the model has. One the config does not declare is turned off, and so is a 10G cage's name for the optic it does not hold. */
     private ports(): void {
         for (const port of Catalog.ports(this.device.platform, this.device.model)) {
-            const settings = this.device.ports?.[port as keyof typeof this.device.ports];
+            const settings = this.device.interfaces?.ethernet?.[port];
             const name = this.names.port(port);
 
             // A 10G cage is `xe-` with a 10G optic and `ge-` with a 1G one. The name not in use stays off, so a swapped optic does not bring up a port nobody configured.
@@ -491,8 +509,8 @@ export class JunosRender {
 
             if (settings.description) this.out.set(`interfaces ${name} description`, JunosRender.quote(settings.description));
 
-            if (settings.lag) {
-                this.out.set(`interfaces ${name} ether-options 802.3ad`, `ae${this.names.lags.get(settings.lag)}`);
+            if (settings.in_lag) {
+                this.out.set(`interfaces ${name} ether-options 802.3ad`, `ae${this.names.lags.get(settings.in_lag)}`);
                 continue;
             }
 
@@ -504,12 +522,15 @@ export class JunosRender {
         }
     }
 
+    /** The device's LAGs, each with its settings, in the order written. */
+    private lagSettings(): [string, Lag][] {
+        return Object.entries(this.device.interfaces?.lag ?? {}).flatMap(([name, lag]) => (lag ? [[name, lag] as [string, Lag]] : []));
+    }
+
     private lags(): void {
         let highest = -1;
 
-        for (const [name, lag] of Object.entries(this.device.interfaces ?? {})) {
-            if (lag.type !== "lag") continue;
-
+        for (const [name, lag] of this.lagSettings()) {
             const physical = this.names.physical(name);
             highest = Math.max(highest, this.names.lags.get(name)!);
 
@@ -528,8 +549,8 @@ export class JunosRender {
 
     /** VLAN interfaces, loopbacks and GRE tunnels: a description, a tunnel's ends, addresses and VRRP, and an MTU per family. */
     private routedInterfaces(): void {
-        for (const [name, iface] of Object.entries(this.device.interfaces ?? {})) {
-            if (iface.type !== "vlan" && iface.type !== "loopback" && iface.type !== "gre") continue;
+        for (const { name, kind, settings: iface } of Derive.interfaces(this.device)) {
+            if (kind !== "vlan_interface" && kind !== "loopback" && kind !== "gre") continue;
 
             const unit = this.names.unit(name);
             const [physical, number] = unit.split(".");
@@ -537,9 +558,10 @@ export class JunosRender {
 
             if (iface.description) this.out.set(`${prefix} description`, JunosRender.quote(iface.description));
 
-            if (iface.type === "gre") {
-                this.out.set(`${prefix} tunnel source`, iface.local);
-                this.out.set(`${prefix} tunnel destination`, iface.remote);
+            const tunnel = kind === "gre" ? this.device.interfaces?.gre?.[name] : undefined;
+            if (tunnel) {
+                this.out.set(`${prefix} tunnel source`, Address.host(tunnel.local_address));
+                this.out.set(`${prefix} tunnel destination`, tunnel.remote_address);
             }
 
             this.addressing(unit, iface);
@@ -555,8 +577,10 @@ export class JunosRender {
     /** One profile per threshold the ports and LAGs name. */
     private stormProfiles(): void {
         const switched: Switched[] = [
-            ...Object.values(this.device.ports ?? {}).filter((settings): settings is AnyPort => !!settings && !settings.lag),
-            ...Object.values(this.device.interfaces ?? {}).filter((iface): iface is LagInterface => iface.type === "lag"),
+            ...Derive.ports(this.device)
+                .filter(([, settings]) => !settings.in_lag)
+                .map(([, settings]) => settings),
+            ...this.lagSettings().map(([, lag]) => lag),
         ];
 
         for (const settings of switched) {
@@ -578,14 +602,17 @@ export class JunosRender {
         const management = this.device.management ?? {};
         const guarded: { service: keyof typeof JunosRender.SERVICE_PORTS; sources: readonly string[] }[] = [];
 
+        // `management.allow` holds addresses by now: an address set's name is turned into its addresses before a platform reads it.
+        const allowed = typeof management.allow === "string" ? undefined : management.allow;
+
         for (const service of Object.keys(JunosRender.SERVICE_PORTS) as (keyof typeof JunosRender.SERVICE_PORTS)[]) {
-            const settings = management[service];
-            const sources = settings?.allow ?? management.allow;
+            const settings = this.serviceSettings(service);
+            const sources = settings?.allow ?? allowed;
             if (settings && sources?.length) guarded.push({ service, sources });
         }
 
         const ntp = this.device.system?.ntp;
-        const keepsTimeQuietly = !!ntp?.servers.length && !ntp.serve;
+        const keepsTimeQuietly = !!ntp?.servers.length && !this.device.services?.ntp_server;
         if (!guarded.length && !keepsTimeQuietly) return;
 
         const families = [
@@ -599,7 +626,7 @@ export class JunosRender {
 
             for (const { service, sources } of guarded) {
                 const [protocol, standardPort] = JunosRender.SERVICE_PORTS[service];
-                const port = management[service]?.port ?? standardPort;
+                const port = this.serviceSettings(service)?.port ?? standardPort;
                 const term = `${filter} term ${service}`;
                 const allowed = sources.filter(ofFamily);
 
@@ -638,9 +665,9 @@ export class JunosRender {
 
         const anchors = new Set(["lo0.0", ...[...this.names.loopbacks.values()].map((unit) => `lo0.${unit}`)]);
 
-        for (const [port, settings] of Object.entries(this.device.ports ?? {})) {
+        for (const [port, settings] of Derive.ports(this.device)) {
             const name = this.names.port(port);
-            if (settings?.addresses?.length && name.startsWith("em")) anchors.add(`${name}.0`);
+            if (settings.addresses?.length && name.startsWith("em")) anchors.add(`${name}.0`);
         }
 
         for (const anchor of anchors) {
@@ -652,15 +679,15 @@ export class JunosRender {
 
     /** A VRF is a virtual router: its own table, holding its interfaces. */
     private vrfs(): void {
-        for (const [name, vrf] of Object.entries(this.device.vrfs ?? {})) {
+        for (const [name, vrf] of Object.entries(this.device.routing?.vrfs ?? {})) {
+            if (!vrf) continue;
+
             this.out.set(`routing-instances ${name} instance-type virtual-router`);
             if (vrf.description) this.out.set(`routing-instances ${name} description`, JunosRender.quote(vrf.description));
         }
 
-        const routed = [...Object.entries(this.device.ports ?? {}), ...Object.entries(this.device.interfaces ?? {})];
-
-        for (const [name, settings] of routed) {
-            if (settings?.vrf) this.out.set(`routing-instances ${settings.vrf} interface`, this.names.unit(name));
+        for (const [name, settings] of this.routed()) {
+            if (settings.vrf) this.out.set(`routing-instances ${settings.vrf} interface`, this.names.unit(name));
         }
     }
 
@@ -668,7 +695,7 @@ export class JunosRender {
     private staticRoutes(): void {
         if (this.device.routing?.router_id) this.out.set("routing-options router-id", this.device.routing.router_id);
 
-        for (const route of this.device.routing?.static ?? []) {
+        for (const route of this.device.routing?.static_routes ?? []) {
             const ipv6 = Address.family(Address.split(route.prefix).addr) === "ipv6";
             const table = ipv6 ? ` rib ${route.vrf ? `${route.vrf}.` : ""}inet6.0` : "";
             const options = route.vrf ? `routing-instances ${route.vrf} routing-options${table}` : `routing-options${table}`;
@@ -680,7 +707,7 @@ export class JunosRender {
                 continue;
             }
 
-            const nextHop = route.via ?? this.names.unit(route.interface!);
+            const nextHop = route.next_hop ? Address.host(route.next_hop) : this.names.unit(route.interface!);
             if (route.distance === undefined) this.out.set(statement, "next-hop", nextHop);
             else this.out.set(statement, "qualified-next-hop", nextHop, "preference", route.distance);
 
@@ -691,7 +718,7 @@ export class JunosRender {
 
     /** Spanning tree on every switched port and LAG, each with its own settings. RSTP when no mode is given. */
     private spanningTree(): void {
-        const stp = this.device.stp;
+        const stp = this.device.switching?.stp;
         if (!stp) return;
 
         // The platform has no plain STP; RSTP is held to it.
@@ -701,13 +728,12 @@ export class JunosRender {
 
         const switched: [string, Switched][] = [];
 
-        for (const [port, settings] of Object.entries(this.device.ports ?? {})) {
-            if (settings && !settings.lag && (settings.access_vlan || settings.trunk_vlans))
-                switched.push([this.names.port(port), settings]);
+        for (const [port, settings] of Derive.ports(this.device)) {
+            if (!settings.in_lag && (settings.access_vlan || settings.trunk_vlans)) switched.push([this.names.port(port), settings]);
         }
 
-        for (const [name, lag] of Object.entries(this.device.interfaces ?? {})) {
-            if (lag.type === "lag" && (lag.access_vlan || lag.trunk_vlans)) switched.push([this.names.physical(name), lag]);
+        for (const [name, lag] of this.lagSettings()) {
+            if (lag.access_vlan || lag.trunk_vlans) switched.push([this.names.physical(name), lag]);
         }
 
         for (const [name, settings] of switched) {
@@ -729,7 +755,7 @@ export class JunosRender {
      * The device sends a port's SNMP index as its port ID unless told to send its name, so a neighbor sees `et-0/0/52` rather than `520`.
      */
     private lldp(): void {
-        const lldp = this.device.lldp;
+        const lldp = this.device.switching?.lldp;
 
         if (Cabling.runsAnywhere(this.device)) this.out.set("protocols lldp port-id-subtype interface-name");
 
@@ -737,9 +763,9 @@ export class JunosRender {
         else if (lldp)
             for (const name of lldp.interfaces) for (const port of this.names.members(name)) this.out.set("protocols lldp interface", port);
 
-        for (const [port, settings] of Object.entries(this.device.ports ?? {})) {
-            if (settings?.lldp === false) this.out.set("protocols lldp interface", this.names.port(port), "disable");
-            else if (settings?.lldp === true) this.out.set("protocols lldp interface", this.names.port(port));
+        for (const [port, settings] of Derive.ports(this.device)) {
+            if (settings.lldp === false) this.out.set("protocols lldp interface", this.names.port(port), "disable");
+            else if (settings.lldp === true) this.out.set("protocols lldp interface", this.names.port(port));
         }
     }
 
@@ -748,18 +774,20 @@ export class JunosRender {
         const ospf = this.device.routing?.ospf;
         if (!ospf) return;
 
-        const protocols = (ospf.families ?? ["ipv4"]).map((family) => (family === "ipv4" ? "ospf" : "ospf3"));
+        const protocols = (ospf.address_families ?? ["ipv4"]).map((family) => (family === "ipv4" ? "ospf" : "ospf3"));
 
         for (const protocol of protocols) {
             for (const [areaId, area] of Object.entries(ospf.areas)) {
                 for (const [iface, settings] of Object.entries(area.interfaces)) {
+                    if (!settings) continue;
+
                     const statement = `protocols ${protocol} area ${areaId} interface ${this.names.unit(iface)}`;
                     this.out.set(statement);
 
-                    if (settings?.cost !== undefined) this.out.set(statement, "metric", settings.cost);
-                    if (settings?.passive) this.out.set(statement, "passive");
-                    if (settings?.network === "point-to-point") this.out.set(statement, "interface-type p2p");
-                    if (settings?.bfd) JunosRender.bfd(this.out, statement, this.device);
+                    if (settings.cost !== undefined) this.out.set(statement, "metric", settings.cost);
+                    if (settings.passive) this.out.set(statement, "passive");
+                    if (settings.network === "point-to-point") this.out.set(statement, "interface-type p2p");
+                    if (settings.bfd) JunosRender.bfd(this.out, statement, this.device);
                 }
             }
 
@@ -775,10 +803,8 @@ export class JunosRender {
 
     /** Each relay is a group of servers and the interface it listens on, in the table that interface routes in. */
     private dhcpRelay(): void {
-        for (const [name, relay] of Object.entries(this.device.dhcp_relay ?? {})) {
-            const vrf =
-                this.device.interfaces?.[relay.interface]?.vrf ??
-                this.device.ports?.[relay.interface as keyof typeof this.device.ports]?.vrf;
+        for (const [name, relay] of Object.entries(this.device.services?.dhcp_relay ?? {})) {
+            const vrf = Derive.settings(this.device, relay.interface)?.vrf;
             const relays = vrf ? `routing-instances ${vrf} forwarding-options dhcp-relay` : "forwarding-options dhcp-relay";
 
             for (const server of relay.servers) this.out.set(`${relays} server-group ${name}`, server);
@@ -789,7 +815,7 @@ export class JunosRender {
 
     /** sFlow from the management address, to each collector, on every declared port or those listed. A LAG is observed on its member ports. */
     private sflow(): void {
-        const flow = this.device.flow_export;
+        const flow = this.device.monitoring?.flow_export;
         if (flow?.protocol !== "sflow") return;
 
         if (this.device.connection.host) this.out.set("protocols sflow agent-id", this.device.connection.host);
@@ -802,7 +828,7 @@ export class JunosRender {
             }
         }
 
-        const declared = Object.entries(this.device.ports ?? {}).filter(([, settings]) => settings && !settings.lag);
+        const declared = Derive.ports(this.device).filter(([, settings]) => !settings.in_lag);
         const observed = flow.interfaces ?? declared.map(([port]) => port);
 
         for (const name of observed) {
@@ -818,18 +844,19 @@ export class JunosRender {
         const switched = new Set<string>();
         const routed = new Set<string>();
 
-        for (const [port, settings] of Object.entries(this.device.ports ?? {})) {
-            if (!settings?.acl) continue;
+        for (const [port, settings] of Derive.ports(this.device)) {
+            const acl = settings.ingress_acl;
+            if (!acl) continue;
 
             const physical = this.names.port(port);
 
             if (settings.access_vlan || settings.trunk_vlans) {
-                switched.add(settings.acl);
-                this.out.set(`interfaces ${physical} unit 0 family ethernet-switching filter input`, settings.acl);
+                switched.add(acl);
+                this.out.set(`interfaces ${physical} unit 0 family ethernet-switching filter input`, acl);
             } else {
-                routed.add(settings.acl);
-                this.out.set(`interfaces ${physical} unit 0 family inet filter input`, `${settings.acl}-v4`);
-                this.out.set(`interfaces ${physical} unit 0 family inet6 filter input`, `${settings.acl}-v6`);
+                routed.add(acl);
+                this.out.set(`interfaces ${physical} unit 0 family inet filter input`, `${acl}-v4`);
+                this.out.set(`interfaces ${physical} unit 0 family inet6 filter input`, `${acl}-v6`);
             }
         }
 
@@ -842,8 +869,8 @@ export class JunosRender {
     }
 
     /** A rule's decision, through a policer when it has a rate. */
-    private aclThen(term: string, policer: string, rule: AnyAclRule): void {
-        if (rule.action === "drop") {
+    private aclThen(term: string, policer: string, rule: AclRule): void {
+        if (rule.then === "drop") {
             this.out.set(term, "then discard");
             return;
         }
@@ -861,8 +888,8 @@ export class JunosRender {
     private switchingFilter(acl: string): void {
         const filter = `firewall family ethernet-switching filter ${acl}`;
 
-        (this.device.acls?.[acl] ?? []).forEach((rule, index) => {
-            const match = rule.match ?? {};
+        (this.device.switching?.acls?.[acl] ?? []).forEach((rule, index) => {
+            const match = rule.if ?? {};
             const addressed = match.src || match.dst || match.protocol || match.src_port !== undefined || match.dst_port !== undefined;
             const family = JunosRender.aclFamily(rule);
             const families = addressed || family ? (family ? [family] : (["ipv4", "ipv6"] as const)) : [undefined];
@@ -875,8 +902,10 @@ export class JunosRender {
                     const version = `from ip-version ${each}`;
                     const v4 = each === "ipv4";
 
-                    if (match.src) this.out.set(term, version, v4 ? "ip-source-address" : "ip6-source-address", match.src);
-                    if (match.dst) this.out.set(term, version, v4 ? "ip-destination-address" : "ip6-destination-address", match.dst);
+                    for (const src of JunosRender.each(match.src))
+                        this.out.set(term, version, v4 ? "ip-source-address" : "ip6-source-address", src);
+                    for (const dst of JunosRender.each(match.dst))
+                        this.out.set(term, version, v4 ? "ip-destination-address" : "ip6-destination-address", dst);
                     if (match.protocol)
                         this.out.set(
                             term,
@@ -902,17 +931,17 @@ export class JunosRender {
         const name = `${acl}-${family === "ipv4" ? "v4" : "v6"}`;
         const filter = `firewall family ${family === "ipv4" ? "inet" : "inet6"} filter ${name}`;
 
-        (this.device.acls?.[acl] ?? []).forEach((rule, index) => {
+        (this.device.switching?.acls?.[acl] ?? []).forEach((rule, index) => {
             const ruleFamily = JunosRender.aclFamily(rule);
             if (ruleFamily && ruleFamily !== family) return;
 
-            const match = rule.match ?? {};
+            const match = rule.if ?? {};
             const label = `${index + 1}`;
             const term = `${filter} term ${JunosRender.ruleName(label, rule.description)}`;
             const protocolWord = family === "ipv4" ? "protocol" : "next-header";
 
-            if (match.src) this.out.set(term, "from source-address", match.src);
-            if (match.dst) this.out.set(term, "from destination-address", match.dst);
+            for (const src of JunosRender.each(match.src)) this.out.set(term, "from source-address", src);
+            for (const dst of JunosRender.each(match.dst)) this.out.set(term, "from destination-address", dst);
             if (match.protocol)
                 this.out.set(term, "from", protocolWord, family === "ipv4" ? match.protocol : JunosRender.nextHeader(match.protocol));
             for (const port of match.src_port !== undefined ? JunosRender.eachPort(match.src_port) : [])
@@ -928,7 +957,7 @@ export class JunosRender {
 
     /** A DHCP server is an address pool with its network, range, options and reservations, served on its interface. */
     private dhcpServers(): void {
-        for (const [name, server] of Object.entries(this.device.dhcp ?? {})) {
+        for (const [name, server] of Object.entries(this.device.services?.dhcp_server ?? {})) {
             this.out.set(`system services dhcp-local-server group ${name} interface`, this.names.unit(server.interface));
 
             const pool = `access address-assignment pool ${name} family inet`;
@@ -952,10 +981,8 @@ export class JunosRender {
 
     /** Router advertisements announce each IPv6 network of the interface. */
     private routerAdvertisements(): void {
-        const routed = [...Object.entries(this.device.ports ?? {}), ...Object.entries(this.device.interfaces ?? {})];
-
-        for (const [name, settings] of routed) {
-            if (!settings?.ipv6_ra) continue;
+        for (const [name, settings] of this.routed()) {
+            if (!settings.ipv6_ra) continue;
 
             const addresses = (settings.addresses ?? []).map((entry) => (typeof entry === "string" ? entry : entry.address));
 
@@ -964,4 +991,12 @@ export class JunosRender {
             }
         }
     }
+
+    /** Every port, then every other interface kind by kind, each with its settings. */
+    private routed(): [string, Port | Interface][] {
+        return [
+            ...Derive.ports(this.device),
+            ...Derive.interfaces(this.device).map(({ name, settings }): [string, Interface] => [name, settings]),
+        ];
+    }
 }