@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/src/platforms/routeros/index.ts

@@ -6,9 +6,9 @@ import type { Client } from "ssh2";
 import { Utils } from "../../core/utils";
 import { Address } from "../../core/address";
 import type { Neighbor } from "../../core/cabling";
-import type { Finding } from "../../core/define";
+import type { Finding } from "../finding";
 import { Secrets } from "../../core/secrets";
-import type { Device, Family } from "../../schema";
+import type { Device, Family } from "../../model";
 import { SerialConsole, type ConsoleDialect, ConsoleShell } from "../../transport/console";
 import { Ssh } from "../../transport/ssh";
 import {
@@ -144,41 +144,41 @@ export class RouterOs extends Platform {
     override readonly console = RouterOs.CONSOLE;
 
     /**
-     * A BGP session with a `table` announces from that table, not from main: each prefix of `networks` it announces needs a route in the table too, or it is not announced (TRAPS.md). A session left with nothing to announce is an error; a prefix missing from its table is a warning, since its export may not announce it anyway.
+     * A BGP session with a `routing_table` announces from that table, not from main: each prefix of `originated_prefixes` it announces needs a route in the table too, or it is not announced (TRAPS.md). A session left with nothing to announce is an error; a prefix missing from its table is a warning, since its export may not announce it anyway.
      */
     checks(device: Device): Finding[] {
         const bgp = device.routing?.bgp;
-        const statics = device.routing?.static ?? [];
+        const statics = device.routing?.static_routes ?? [];
         const findings: Finding[] = [];
 
         for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
-            const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
-            const table = Utils.otherTable(neighbor.table ?? group?.table);
+            const group = neighbor.neighbor_group ? bgp?.neighbor_groups?.[neighbor.neighbor_group] : undefined;
+            const table = Utils.otherTable(neighbor.routing_table ?? group?.routing_table);
             if (!table) continue;
 
-            const families = neighbor.families ?? group?.families ?? [Address.family(neighbor.address)];
-            const networks = (bgp?.networks ?? []).filter((prefix) => families.includes(Address.family(Address.host(prefix))));
+            const families = neighbor.address_families ?? group?.address_families ?? [Address.family(neighbor.address)];
+            const originated = (bgp?.originated_prefixes ?? []).filter((prefix) => families.includes(Address.family(Address.host(prefix))));
             const inTable = (prefix: string) =>
-                statics.some((route) => route.table === table && Address.canonical(route.prefix) === Address.canonical(prefix));
-            // What its export accepts by prefix: a network it would reject anyway needs no route in the table. Every network when the export names none.
-            const exportPolicy = neighbor.export ?? group?.export;
-            const accepted = (exportPolicy ? (device.policies?.[exportPolicy] ?? []) : [])
-                .filter((rule) => rule.action === "accept" && rule.match?.prefix)
-                .map((rule) => Address.canonical(rule.match!.prefix!));
-            const announced = accepted.length ? networks.filter((prefix) => accepted.includes(Address.canonical(prefix))) : networks;
+                statics.some((route) => route.routing_table === table && Address.canonical(route.prefix) === Address.canonical(prefix));
+            // What its export accepts by prefix: a prefix it would reject anyway needs no route in the table. Every prefix when the export names none.
+            const exportPolicy = neighbor.export_policy ?? group?.export_policy;
+            const accepted = (exportPolicy ? (device.routing?.policies?.[exportPolicy] ?? []) : [])
+                .flatMap((rule) => (RouterOsRender.onRoutes(rule) && rule.then === "accept" && rule.if?.prefix ? [rule.if.prefix] : []))
+                .map((prefix) => Address.canonical(prefix));
+            const announced = accepted.length ? originated.filter((prefix) => accepted.includes(Address.canonical(prefix))) : originated;
 
             const missing = announced.filter((prefix) => !inTable(prefix));
             if (!missing.length) continue;
 
             const where = `routing.bgp.neighbors.${name}`;
-            const route = (prefix: string) => `{ prefix: "${prefix}", blackhole: true, table: "${table}" }`;
+            const route = (prefix: string) => `{ prefix: "${prefix}", blackhole: true, routing_table: "${table}" }`;
             const fix = `On RouterOS a session announces from its own table, ${table}`;
 
             if (missing.length === announced.length) {
                 findings.push({
                     level: "error",
                     device: device.name,
-                    message: `${where} would announce nothing: ${fix}, which has no route for any of networks. Add the routes it announces to ${table} too, such as ${route(missing[0]!)} in routing.static`,
+                    message: `${where} would announce nothing: ${fix}, which has no route for any of originated_prefixes. Add the routes it announces to ${table} too, such as ${route(missing[0]!)} in routing.static_routes`,
                 });
                 continue;
             }
@@ -187,7 +187,7 @@ export class RouterOs extends Platform {
                 findings.push({
                     level: "warning",
                     device: device.name,
-                    message: `${where} does not announce ${prefix}: ${fix}, which has no route for it. If its export should announce it, add ${route(prefix)} to routing.static`,
+                    message: `${where} does not announce ${prefix}: ${fix}, which has no route for it. If its export should announce it, add ${route(prefix)} to routing.static_routes`,
                 });
             }
         }
@@ -198,74 +198,89 @@ export class RouterOs extends Platform {
     unsupported(device: Device): string[] {
         const found: string[] = [];
 
-        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-            if (iface.type === "bridge") found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
+        for (const [name] of RouterOsRender.entries(device.interfaces?.bridge)) {
+            found.push(`interfaces.bridge.${name}, a bridge, which only FortiOS builds for now`);
         }
 
-        for (const [name, port] of Object.entries(device.ports ?? {})) {
-            if (!port) continue;
-
+        for (const [name, port] of Derive.ports(device)) {
             if (port.speed && !RouterOsRender.medium(Catalog.spell(device.platform, device.model, name), port.speed)) {
-                found.push(`ports.${name}.speed ${port.speed}, the port has no fixed speed by that name`);
+                found.push(`interfaces.ethernet.${name}.speed ${port.speed}, the port has no fixed speed by that name`);
             }
 
-            const thresholds = Object.values(port.storm_control ?? {});
+            const thresholds = Object.values(port.storm_control ?? {}).filter((threshold) => threshold !== undefined);
             const percents = new Set(thresholds.map((threshold) => ("percent" in threshold ? threshold.percent : undefined)));
 
-            if (port.mac_limit !== undefined) found.push(`ports.${name}.mac_limit, ${RouterOs.NO_MAC_LIMIT}`);
+            if (port.mac_limit !== undefined) found.push(`interfaces.ethernet.${name}.mac_limit, ${RouterOs.NO_MAC_LIMIT}`);
 
             if (thresholds.some((threshold) => "pps" in threshold)) {
-                found.push(`ports.${name}.storm_control in pps, the platform takes percent`);
+                found.push(`interfaces.ethernet.${name}.storm_control in pps, the platform takes percent`);
             } else if (percents.size > 1) {
-                found.push(`ports.${name}.storm_control with a different percent per kind, the platform takes one`);
+                found.push(`interfaces.ethernet.${name}.storm_control with a different percent per kind, the platform takes one`);
             }
         }
 
-        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-            if (iface.type !== "lag") continue;
+        // Routing in software is set per VLAN interface, on the switch chip that offloads.
+        for (const [name, port] of Derive.ports(device))
+            if (port.hardware_offload !== undefined) found.push(`interfaces.ethernet.${name}.hardware_offload, set on a VLAN interface`);
+        for (const { name, kind, settings } of Derive.interfaces(device)) {
+            if (settings.hardware_offload === undefined) continue;
+            if (kind !== "vlan_interface") found.push(`interfaces.${kind}.${name}.hardware_offload, set on a VLAN interface`);
+            else if (settings.hardware_offload && !device.system?.hardware_offload)
+                found.push(`interfaces.vlan_interface.${name}.hardware_offload true while system.hardware_offload is off`);
+        }
 
-            if (iface.mac_limit !== undefined) found.push(`interfaces.${name}.mac_limit, ${RouterOs.NO_MAC_LIMIT}`);
-            if (iface.ethertypes !== undefined) found.push(`interfaces.${name}.ethertypes, on a LAG, which is not proved on a device yet`);
+        for (const [name, lag] of RouterOsRender.entries(device.interfaces?.lag)) {
+            if (lag.mac_limit !== undefined) found.push(`interfaces.lag.${name}.mac_limit, ${RouterOs.NO_MAC_LIMIT}`);
+            if (lag.ethertypes !== undefined)
+                found.push(`interfaces.lag.${name}.ethertypes, on a LAG, which is not proved on a device yet`);
 
             for (const field of ["storm_control", "stp"] as const) {
-                if (iface[field] !== undefined) found.push(`interfaces.${name}.${field}, on a LAG`);
+                if (lag[field] !== undefined) found.push(`interfaces.lag.${name}.${field}, on a LAG`);
             }
         }
 
         const bgp = device.routing?.bgp;
 
         for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
-            const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
-            const families = neighbor.families ?? group?.families ?? [Address.family(neighbor.address)];
+            const group = neighbor.neighbor_group ? bgp?.neighbor_groups?.[neighbor.neighbor_group] : undefined;
+            const families = neighbor.address_families ?? group?.address_families ?? [Address.family(neighbor.address)];
 
-            if (families.length > 1) found.push(`routing.bgp.neighbors.${name}.families, one family per session`);
+            if (families.length > 1) found.push(`routing.bgp.neighbors.${name}.address_families, one family per session`);
         }
 
         const management = device.management;
+        const snmp = device.monitoring?.snmp;
 
         if (management?.console) found.push("management.console, the console uses the device's users");
         if (management?.interfaces) found.push("management.interfaces, which only FortiOS builds for now");
         if (management?.privilege_password) found.push("management.privilege_password, the platform has no privileged mode");
 
-        if (management?.snmp?.port) found.push("management.snmp.port");
+        if (snmp?.port) found.push("monitoring.snmp.port");
 
         if (management?.ssh?.auth_timeout || management?.ssh?.auth_retries) {
             found.push("management.ssh.auth_timeout and auth_retries");
         }
 
-        for (const [name, user] of Object.entries(management?.snmp?.users ?? {})) {
+        for (const [name, user] of Object.entries(snmp?.users ?? {})) {
             if (user.auth !== "sha1") {
-                found.push(`management.snmp.users.${name}.auth ${user.auth}, the platform authenticates with SHA1 or MD5`);
+                found.push(
+                    `monitoring.snmp.users.${name}.auth ${user.auth}: Circuit writes SHA1 only on RouterOS (SHA-2 comes with RouterOS 7.26, not proved yet)`
+                );
             }
         }
 
-        if (device.system?.transceiver_monitoring === false) found.push("system.transceiver_monitoring false, it is always on");
-        if (device.flow_export?.protocol === "sflow") found.push("flow_export.protocol sflow, the platform exports NetFlow and IPFIX");
+        if (device.monitoring?.transceivers === false) found.push("monitoring.transceivers false, it is always on");
+        if (device.monitoring?.flow_export?.protocol === "sflow") {
+            found.push("monitoring.flow_export.protocol sflow, the platform exports NetFlow and IPFIX");
+        }
 
-        for (const route of device.routing?.static ?? []) {
-            if (route.bfd) found.push(`routing.static ${route.prefix} bfd, a static route's check-gateway takes arp, none or ping on 7.23`);
+        for (const route of device.routing?.static_routes ?? []) {
+            if (route.bfd)
+                found.push(`routing.static_routes ${route.prefix} bfd, a static route's check-gateway takes arp, none or ping on 7.23`);
         }
 
+        found.push(...RouterOs.unsupportedShapes(device));
+
         // BFD on a static route and a MAC limit are refused above, for the reason the device gave, and an ethertype filter on a LAG as unproved.
         found.push(
             ...Derive.unproved(device, [
@@ -281,6 +296,54 @@ export class RouterOs extends Platform {
         return found;
     }
 
+    /** What the v1 model can write that the platform does not render: a list of values in one rule's match, an interface set, an address set named in `management.allow`, and a `{ communities }` rule. */
+    private static unsupportedShapes(device: Device): string[] {
+        const found: string[] = [];
+        const firewall = device.firewall;
+        const list = (value: unknown) => Array.isArray(value) && value.length > 1;
+
+        if (firewall?.interface_sets) found.push("firewall.interface_sets, which the platform does not build yet");
+
+        const chains = (["input", "forward", "output"] as const).map(
+            (chain) => [`firewall.filter.${chain}.rules`, firewall?.filter?.[chain]?.rules] as const
+        );
+        const nat = [
+            ["firewall.nat.source", firewall?.nat?.source],
+            ["firewall.nat.destination", firewall?.nat?.destination],
+        ] as const;
+
+        for (const [where, rules] of [...chains, ...nat]) {
+            (rules ?? []).forEach((rule, index) => {
+                for (const field of ["src", "dst", "in_interface", "out_interface"] as const) {
+                    if (list(rule.if?.[field])) found.push(`${where}[${index}].if.${field}, a list: write one rule for each`);
+                }
+
+                for (const field of ["in_interface_set", "out_interface_set"] as const) {
+                    if (rule.if?.[field] !== undefined) found.push(`${where}[${index}].if.${field}, which the platform does not build yet`);
+                }
+            });
+        }
+
+        for (const [name, rules] of RouterOsRender.entries(device.switching?.acls)) {
+            rules.forEach((rule, index) => {
+                for (const field of ["src", "dst", "vlan"] as const) {
+                    if (list(rule.if?.[field])) found.push(`switching.acls.${name}[${index}].if.${field}, a list: write one rule for each`);
+                }
+            });
+        }
+
+        const allow = device.management?.allow;
+        if (typeof allow === "string") found.push(`management.allow ${allow}, an address set by name: write its prefixes`);
+
+        for (const [name, rules] of RouterOsRender.entries(device.routing?.policies)) {
+            rules.forEach((rule, index) => {
+                if (rule.communities !== undefined) found.push(`routing.policies.${name}[${index}].communities ${rule.communities}`);
+            });
+        }
+
+        return found;
+    }
+
     render(device: Device): string {
         return RouterOsRender.of(device);
     }
@@ -487,7 +550,7 @@ export class RouterOs extends Platform {
     }
 
     /**
-     * Three checks after an apply. When the plan touched switch rules, none may be invalid. BGP sessions established before the apply must be established again, and announce again each of the device's `networks` they announced before, within `BgpWait.AFTER_APPLY`. A session can stay up and stop announcing (TRAPS.md), which the session check alone would not see.
+     * Three checks after an apply. When the plan touched switch rules, none may be invalid. BGP sessions established before the apply must be established again, and announce again each of the device's `originated_prefixes` they announced before, within `BgpWait.AFTER_APPLY`. A session can stay up and stop announcing (TRAPS.md), which the session check alone would not see.
      */
     async health(device: Device, plan: Plan, options: HealthOptions = {}): Promise<HealthCheck> {
         const switchRules = plan.steps.some((step) => step.send.some((command) => command.startsWith(RouterOs.SWITCH_RULES)));
@@ -551,9 +614,7 @@ export class RouterOs extends Platform {
      */
     private static farPort(network: readonly Device[], system: string, reported: string): string {
         const far = network.find((candidate) => system === candidate.name || system.startsWith(`${candidate.name}.`));
-        const described = Object.entries(far?.ports ?? {})
-            .filter(([, port]) => port?.description === reported)
-            .map(([name]) => name);
+        const described = (far ? Derive.ports(far) : []).filter(([, port]) => port.description === reported).map(([name]) => name);
 
         return described.length === 1 ? described[0]! : reported;
     }
@@ -625,9 +686,9 @@ export class RouterOs extends Platform {
         );
     }
 
-    /** What each session announces of the device's own `networks`, as `neighbor prefix`. None, without logging in, on a device without networks. */
+    /** What each session announces of the device's own `originated_prefixes`, as `neighbor prefix`. None, without logging in, on a device that originates none. */
     private async announcedNow(device: Device, options: ReadOptions): Promise<string[]> {
-        if (!device.routing?.bgp?.networks?.length) return [];
+        if (!device.routing?.bgp?.originated_prefixes?.length) return [];
 
         const session = await this.session(device, options);
 
@@ -638,11 +699,11 @@ export class RouterOs extends Platform {
         }
     }
 
-    /** The `networks` each session announces, as `neighbor prefix`, sorted. An advertisement names its session, which is matched to its neighbor by address first, as in `bgpSessions`. */
+    /** The `originated_prefixes` each session announces, as `neighbor prefix`, sorted. An advertisement names its session, which is matched to its neighbor by address first, as in `bgpSessions`. */
     private async announced(device: Device, session: ReadSession): Promise<string[]> {
         const bgp = device.routing?.bgp;
-        const networks = bgp?.networks ?? [];
-        if (!networks.length) return [];
+        const originated = bgp?.originated_prefixes ?? [];
+        if (!originated.length) return [];
 
         const sessions = (await session.run(RouterOs.LIST_BGP_SESSIONS, 60_000))
             .split(/\r?\n/)
@@ -656,7 +717,7 @@ export class RouterOs extends Platform {
             return (byAddress ?? byName)?.[0];
         };
 
-        const output = await session.run(RouterOs.listAdvertisements(networks), 60_000);
+        const output = await session.run(RouterOs.listAdvertisements(originated), 60_000);
         return output
             .split(/\r?\n/)
             .map((line) => line.trim().split("|"))
@@ -687,7 +748,7 @@ export class RouterOs extends Platform {
 
         return gone.map((pair) => {
             const [neighbor, prefix] = pair.split(" ");
-            return `BGP session ${neighbor} announced ${prefix} before the apply and does not ${limits.seconds} s after it, though it may still be established. A RouterOS session announces from its routing table: that table needs a route for ${prefix}, and a session whose table changed must restart. Look with: circuit show ${device.name} '/routing bgp advertisements print'`;
+            return `BGP session ${neighbor} announced ${prefix} before the apply and does not ${limits.seconds} s after it, though it may still be established. A RouterOS session announces from its routing table: that table needs a route for ${prefix}, and a session whose table changed must restart. Look with: circuit exec ${device.name} '/routing bgp advertisements print'`;
         });
     }
 
@@ -703,7 +764,7 @@ export class RouterOs extends Platform {
         }
 
         return [
-            `${invalid} switch rule(s) are invalid: the switch chip cannot hold them, and every rule after the first invalid one is invalid too, so those rules do nothing. Use fewer distinct port ranges in this device's ACLs, then apply again. See them with: circuit show ${device.name} '${RouterOs.SWITCH_RULES} print where invalid'`,
+            `${invalid} switch rule(s) are invalid: the switch chip cannot hold them, and every rule after the first invalid one is invalid too, so those rules do nothing. Use fewer distinct port ranges in this device's ACLs, then apply again. See them with: circuit exec ${device.name} '${RouterOs.SWITCH_RULES} print where invalid'`,
         ];
     }
 
@@ -737,7 +798,7 @@ export class RouterOs extends Platform {
         const opened = await SerialConsole.open(console);
 
         try {
-            await SerialConsole.login(opened.channel, RouterOs.CONSOLE, user, password, console.passwordOnly);
+            await SerialConsole.login(opened.channel, RouterOs.CONSOLE, user, password, console.password_only);
         } catch (error) {
             opened.close();
             throw error;
@@ -748,7 +809,7 @@ export class RouterOs extends Platform {
         const session: Session = {
             run: (command, timeout) => shell.run(command, timeout),
             fresh: async () => {
-                await SerialConsole.login(opened.channel, RouterOs.CONSOLE, user, password, console.passwordOnly);
+                await SerialConsole.login(opened.channel, RouterOs.CONSOLE, user, password, console.password_only);
                 return session;
             },
             end: () => {
@@ -798,12 +859,12 @@ export class RouterOs extends Platform {
 
     /** Upload a certificate and its key, import both under one name, and delete the files. */
     private static async installCertificate(session: Session, device: Device, name: string): Promise<void> {
-        const certificate = device.certificates?.[name];
-        if (!certificate) throw new Error(`certificate ${name} is not declared`);
+        const certificate = device.system?.certificates?.[name];
+        if (!certificate) throw new Error(`certificate ${name} is not declared in system.certificates`);
         if (!session.upload)
             throw new Error(`certificate ${name} is installed from a file, which only SSH can write; apply it without --console`);
 
-        await session.upload(`${name}.crt`, certificate.certificate);
+        await session.upload(`${name}.crt`, Utils.projectFile(certificate.certificate_file));
         await session.run(`/certificate import file-name=${name}.crt name=${name} passphrase=""`);
 
         if (certificate.private_key) {