@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/src/platforms/routeros/render.ts

@@ -10,30 +10,29 @@ import type {
     Ethertype,
     Family,
     FilterMatch,
-    Interface,
+    Lag,
     NatRule,
     Neighbor,
     NeighborSettings,
     PolicyRule,
     Port,
     Ports,
+    Prefix,
+    RouteRule,
     Service,
     Severity,
-} from "../../schema";
+    VlanInterface,
+} from "../../model";
 import { Catalog } from "../catalog";
+import { Derive, type NamedInterface } from "../derive";
 
 /** A property value as a command takes it. `undefined` and `false` leave the property out. */
 export type Value = string | number | undefined | false;
 
-export type AnyPort = Port<string, string, string, string>;
-
 /** One switch rule: the port it is on, the ACL rule it comes from, and the one source and destination port or range it takes. */
-export type SwitchRule = { port: string; rule: AclRule<string>; srcPort?: string; dstPort?: string };
-export type AnyInterface = Interface<string, string>;
+export type SwitchRule = { port: string; rule: AclRule; srcPort?: string; dstPort?: string };
 
-type Speed = NonNullable<AnyPort["speed"]>;
-type AnyRule = PolicyRule<string, string>;
-type AnyNeighbor = Neighbor<string, string, string>;
+type Speed = NonNullable<Port["speed"]>;
 
 /** One device's render: the device, and the commands collected under their menu. */
 export class RouterOsRender {
@@ -85,7 +84,7 @@ export class RouterOsRender {
         "rs-client": "ebgp-rs",
     } as const;
 
-    /** Neutral service name to the platform's. `native` is the platform's own desktop client. */
+    /** Neutral service name to the platform's. `native_protocol` is the platform's own desktop client. */
     private static readonly SERVICES = {
         ftp: "ftp",
         ssh: "ssh",
@@ -94,12 +93,11 @@ export class RouterOsRender {
         https: "www-ssl",
         api: "api",
         api_tls: "api-ssl",
-        native: "winbox",
+        native_protocol: "winbox",
     } as const;
 
     private static readonly USER_GROUPS = { admin: "full", operator: "write", "read-only": "read" } as const;
 
-    private static readonly SNMP_AUTH = { sha1: "SHA1", sha256: "SHA1" } as const;
     private static readonly SNMP_PRIVACY = { aes128: "AES", des: "DES" } as const;
 
     /** Severity threshold to the topics the platform logs under, most severe first. */
@@ -112,17 +110,41 @@ export class RouterOsRender {
     ];
     private static readonly SEVERITY_ORDER: Severity[] = ["emergency", "alert", "critical", "error", "warning", "notice", "info", "debug"];
 
-    private readonly ports: Record<string, AnyPort>;
-    private readonly interfaces: Record<string, AnyInterface>;
+    private readonly ports: Record<string, Port>;
+
+    /** Every interface that is not a port, kind by kind. */
+    private readonly interfaces: NamedInterface[];
 
     /** Commands under their menu. */
     private readonly menus = new Map<string, string[]>();
 
     private constructor(private readonly device: Device) {
-        this.ports = Object.fromEntries(
-            Object.entries(device.ports ?? {}).filter((entry): entry is [string, AnyPort] => entry[1] !== undefined)
-        );
-        this.interfaces = device.interfaces ?? {};
+        this.ports = Object.fromEntries(Derive.ports(device));
+        this.interfaces = Derive.interfaces(device);
+    }
+
+    /** The entries of a map keyed by name, without the names whose value is left out. */
+    static entries<V>(map: { readonly [name: string]: V | undefined } | undefined): [string, V][] {
+        return Object.entries(map ?? {}).flatMap(([name, value]) => (value === undefined ? [] : [[name, value] as [string, V]]));
+    }
+
+    /** A value of a match: the one written, or the only one of a list. `unsupported()` refuses a list of more. */
+    static one<T>(value: T | readonly T[] | undefined): T | undefined {
+        return Array.isArray(value) ? (value as readonly T[])[0] : (value as T | undefined);
+    }
+
+    /** A route policy rule on routes: not a call, and not a `{ communities }` rule, which `unsupported()` refuses. */
+    static onRoutes(rule: PolicyRule): rule is RouteRule {
+        return rule.call === undefined && rule.communities === undefined;
+    }
+
+    /** A prefix set's prefixes, written as a list or as a map of named prefixes. Undefined for a set fetched from a registry. */
+    static prefixesOf(device: Device, set: string): readonly Prefix[] | undefined {
+        const declared = device.routing?.prefix_sets?.[set];
+        if (!declared || !("prefixes" in declared)) return undefined;
+
+        const prefixes = declared.prefixes;
+        return Array.isArray(prefixes) ? prefixes : Object.values(prefixes);
     }
 
     /** The whole configuration the device should run. */
@@ -261,8 +283,8 @@ export class RouterOsRender {
     }
 
     /** The conditions of a rule, as the platform's filter language writes them. */
-    private static conditions(rule: AnyRule): string[] {
-        const match = rule.match ?? {};
+    private static conditions(rule: RouteRule): string[] {
+        const match = rule.if ?? {};
         const tests: string[] = [];
         if (match.prefix) tests.push(`dst==${match.prefix}`);
         if (match.prefix_set) tests.push(`dst in ${match.prefix_set}`);
@@ -271,25 +293,25 @@ export class RouterOsRender {
         if (match.as_path_length?.min !== undefined) tests.push(`bgp-path-len>${match.as_path_length.min - 1}`);
         if (match.as_path_length?.max !== undefined) tests.push(`bgp-path-len<${match.as_path_length.max + 1}`);
         // The platform's AS path regexp matches each AS as a whole number, so a bare number is that AS anywhere in the path.
-        if (match.through_as !== undefined) tests.push(`bgp-as-path ${match.through_as}`);
+        if (match.as_path_contains !== undefined) tests.push(`bgp-as-path ${match.as_path_contains}`);
         if (match.rpki) tests.push(`rpki ${match.rpki}`);
-        if (match.community) tests.push(`bgp-communities includes ${match.community}`);
+        if (match.standard_community) tests.push(`bgp-communities includes ${match.standard_community}`);
         if (match.large_community) tests.push(`bgp-large-communities includes ${match.large_community}`);
         return tests;
     }
 
     /** What a rule does to a matching route, then its decision. */
-    private static actions(rule: AnyRule, family: Family): string[] {
+    private static actions(rule: RouteRule, family: Family): string[] {
         const set = rule.set ?? {};
         const steps: string[] = [];
         if (set.local_pref !== undefined) steps.push(`set bgp-local-pref ${set.local_pref}`);
         if (set.med !== undefined) steps.push(`set bgp-med ${set.med}`);
         if (set.prepend !== undefined) steps.push(`set bgp-path-prepend ${set.prepend}`);
-        for (const pattern of set.remove_communities ?? []) {
+        for (const pattern of set.remove_standard_communities ?? []) {
             steps.push(`delete bgp-communities regexp "${RouterOsRender.communityPattern(pattern)}"`);
         }
-        if (set.communities) steps.push(`set bgp-communities ${set.communities.join(",")}`);
-        if (set.add_communities) steps.push(`append bgp-communities ${set.add_communities.join(",")}`);
+        if (set.standard_communities) steps.push(`set bgp-communities ${set.standard_communities.join(",")}`);
+        if (set.add_standard_communities) steps.push(`append bgp-communities ${set.add_standard_communities.join(",")}`);
 
         for (const pattern of set.remove_large_communities ?? []) {
             steps.push(`delete bgp-large-communities regexp "${RouterOsRender.communityPattern(pattern)}"`);
@@ -299,18 +321,21 @@ export class RouterOsRender {
         if (set.add_large_communities) steps.push(`append bgp-large-communities ${set.add_large_communities.join(",")}`);
         // An address only means something to routes of its own family.
         if (set.next_hop && Address.family(set.next_hop) === family) steps.push(`set gw ${set.next_hop}`);
-        if (set.preferred_source && Address.family(set.preferred_source) === family) steps.push(`set pref-src ${set.preferred_source}`);
+        const preferredSource = set.preferred_source && Address.host(set.preferred_source);
+        if (preferredSource && Address.family(preferredSource) === family) steps.push(`set pref-src ${preferredSource}`);
         if (set.blackhole) steps.push("set blackhole yes");
-        if (rule.action) steps.push(rule.action);
+        if (rule.then) steps.push(rule.then);
         return steps;
     }
 
     /** One rule as the platform writes it: hand off, ask the validator, test, change, decide. */
-    private static ruleText(rule: AnyRule, family: Family): string {
+    private static ruleText(rule: PolicyRule, family: Family): string {
+        if (rule.call) return `jump ${RouterOsRender.chainName(rule.call, family)}`;
+        if (!RouterOsRender.onRoutes(rule)) return "";
+
         const parts: string[] = [];
-        if (rule.call) parts.push(`jump ${RouterOsRender.chainName(rule.call, family)}`);
         // An RPKI state is only known once the validator has been asked, per route, so the question goes on the same rule.
-        if (rule.match?.rpki) parts.push(`rpki-verify ${RouterOsRender.RPKI_GROUP}`);
+        if (rule.if?.rpki) parts.push(`rpki-verify ${RouterOsRender.RPKI_GROUP}`);
 
         const tests = RouterOsRender.conditions(rule);
         const steps = RouterOsRender.actions(rule, family);
@@ -353,49 +378,34 @@ export class RouterOsRender {
 
     /** What the platform calls a port or an interface. A port is spelled by the model; an interface keeps its config name. */
     private name(portOrInterface: string): string {
-        if (portOrInterface in this.interfaces) return portOrInterface;
+        if (this.interfaces.some((entry) => entry.name === portOrInterface)) return portOrInterface;
 
         return Catalog.spell(this.device.platform, this.device.model, portOrInterface);
     }
 
     /** The number of a VLAN, by its config name. */
     private vlanId(vlan: string): number {
-        const declared = this.device.vlans?.[vlan];
+        const declared = this.device.switching?.vlans?.[vlan];
         if (!declared) throw new Error(`${this.device.name}: VLAN ${vlan} is not declared`);
         return declared.id;
     }
 
     /** Ports and LAGs that are layer 2 members of a VLAN, with their settings. A port in a LAG is represented by the LAG. */
-    private switched(): [string, AnyPort | Extract<AnyInterface, { type: "lag" }>][] {
-        const ports = Object.entries(this.ports).filter(([, port]) => !port.lag && (port.access_vlan || port.trunk_vlans));
-        const lags = Object.entries(this.interfaces).filter((entry): entry is [string, Extract<AnyInterface, { type: "lag" }>] => {
-            const lag = entry[1];
-            return lag.type === "lag" && Boolean(lag.access_vlan || lag.trunk_vlans);
-        });
+    private switched(): [string, Port | Lag][] {
+        const ports = Object.entries(this.ports).filter(([, port]) => !port.in_lag && (port.access_vlan || port.trunk_vlans));
+        const lags = RouterOsRender.entries(this.device.interfaces?.lag).filter(([, lag]) => Boolean(lag.access_vlan || lag.trunk_vlans));
         return [...ports, ...lags];
     }
 
     /** VLAN interfaces, with their settings. */
-    private declaredVlanInterfaces(): [string, Extract<AnyInterface, { type: "vlan" }>][] {
-        return Object.entries(this.interfaces).filter(
-            (
-                entry
-            ): entry is [
-                string,
-                Extract<
-                    AnyInterface,
-                    {
-                        type: "vlan";
-                    }
-                >,
-            ] => entry[1].type === "vlan"
-        );
+    private declaredVlanInterfaces(): [string, VlanInterface][] {
+        return RouterOsRender.entries(this.device.interfaces?.vlan_interface);
     }
 
     /** Every port and interface that holds addresses or other layer 3 settings. Ports are named as the platform spells them. */
-    private routed(): { name: string; settings: AnyPort | AnyInterface }[] {
+    private routed(): { name: string; settings: Port | NamedInterface["settings"] }[] {
         const ports = Object.entries(this.ports).map(([port, settings]) => ({ name: this.name(port), settings }));
-        const interfaces = Object.entries(this.interfaces).map(([name, settings]) => ({ name, settings }));
+        const interfaces = this.interfaces.map(({ name, settings }) => ({ name, settings }));
         return [...ports, ...interfaces];
     }
 
@@ -422,7 +432,7 @@ export class RouterOsRender {
      * Restarting the offload after a failure, and offloading IPv6 too, follow the same switch.
      */
     private hardwareOffload(): void {
-        const on = RouterOsRender.yesNo(this.device.hardware_offload);
+        const on = RouterOsRender.yesNo(this.device.system?.hardware_offload);
         this.add("/interface ethernet switch", "set switch1", { "l3-hw-offloading": on });
         this.add("/interface ethernet switch l3hw-settings", "set", { autorestart: on, "ipv6-hw": on });
     }
@@ -433,7 +443,7 @@ export class RouterOsRender {
         const needsBridge = this.switched().length > 0 || this.declaredVlanInterfaces().length > 0;
 
         if (needsBridge) {
-            const stp = device.stp;
+            const stp = device.switching?.stp;
             const protocolMode = stp ? (stp.mode ?? "rstp") : "none";
             const priority = stp?.priority === undefined ? undefined : `0x${stp.priority.toString(16)}`;
             this.add("/interface bridge", "add", {
@@ -444,10 +454,8 @@ export class RouterOsRender {
             });
         }
 
-        for (const [name, iface] of Object.entries(this.interfaces)) {
-            if (iface.type !== "loopback") continue;
-
-            this.add("/interface bridge", "add", { comment: iface.description, name });
+        for (const [name, loopback] of RouterOsRender.entries(device.interfaces?.loopback)) {
+            this.add("/interface bridge", "add", { comment: loopback.description, name });
         }
     }
 
@@ -499,11 +507,9 @@ export class RouterOsRender {
 
     /** A LAG is a bonding interface. Its members are named as the platform spells them. */
     private lags(): void {
-        for (const [name, lag] of Object.entries(this.interfaces)) {
-            if (lag.type !== "lag") continue;
-
+        for (const [name, lag] of RouterOsRender.entries(this.device.interfaces?.lag)) {
             const members = Object.entries(this.ports)
-                .filter(([, port]) => port.lag === name)
+                .filter(([, port]) => port.in_lag === name)
                 .map(([port]) => this.name(port));
             const mode = lag.mode === "static" ? "balance-xor" : "802.3ad";
             this.add("/interface bonding", "add", {
@@ -524,7 +530,7 @@ export class RouterOsRender {
      */
     private vlanInterfaces(): void {
         for (const [name, iface] of this.declaredVlanInterfaces()) {
-            const softwareOnly = this.device.hardware_offload && iface.hardware_offload === false;
+            const softwareOnly = this.device.system?.hardware_offload && iface.hardware_offload === false;
             const vlanName = iface.mac ? RouterOsRender.underMacvlan(name) : name;
 
             this.add("/interface vlan", "add", {
@@ -549,38 +555,34 @@ export class RouterOsRender {
     }
 
     private tunnels(): void {
-        for (const [name, iface] of Object.entries(this.interfaces)) {
-            if (iface.type === "gre") {
-                this.add("/interface gre", "add", {
-                    comment: iface.description,
-                    "local-address": iface.local,
-                    mtu: iface.mtu,
-                    name,
-                    "remote-address": iface.remote,
-                });
-            }
+        for (const [name, gre] of RouterOsRender.entries(this.device.interfaces?.gre)) {
+            this.add("/interface gre", "add", {
+                comment: gre.description,
+                "local-address": Address.host(gre.local_address),
+                mtu: gre.mtu,
+                name,
+                "remote-address": gre.remote_address,
+            });
+        }
 
-            if (iface.type === "vxlan") {
-                // 4789 is the platform's default and is not written.
-                const port = iface.port && iface.port !== 4789 ? iface.port : undefined;
-                this.add("/interface vxlan", "add", {
-                    comment: iface.description,
-                    "local-address": iface.local,
-                    "mac-address": iface.mac,
-                    mtu: iface.mtu,
-                    name,
-                    port,
-                    vni: iface.vni,
-                });
-                this.add("/interface vxlan vteps", "add", { interface: name, "remote-ip": iface.remote });
-            }
+        for (const [name, vxlan] of RouterOsRender.entries(this.device.interfaces?.vxlan)) {
+            // 4789 is the platform's default and is not written.
+            const port = vxlan.port && vxlan.port !== 4789 ? vxlan.port : undefined;
+            this.add("/interface vxlan", "add", {
+                comment: vxlan.description,
+                "local-address": Address.host(vxlan.local_address),
+                "mac-address": vxlan.mac,
+                mtu: vxlan.mtu,
+                name,
+                port,
+                vni: vxlan.vni,
+            });
+            this.add("/interface vxlan vteps", "add", { interface: name, "remote-ip": vxlan.remote_address });
         }
     }
 
     private wireguard(): void {
-        for (const [name, iface] of Object.entries(this.interfaces)) {
-            if (iface.type !== "wireguard") continue;
-
+        for (const [name, iface] of RouterOsRender.entries(this.device.interfaces?.wireguard)) {
             this.add("/interface wireguard", "add", {
                 comment: iface.description,
                 "listen-port": iface.listen_port,
@@ -652,7 +654,7 @@ export class RouterOsRender {
 
     /** A VLAN is tagged on every trunk carrying it, and on the bridge itself when the router has an interface in it. */
     private bridgeVlans(): void {
-        for (const [vlanName, vlan] of Object.entries(this.device.vlans ?? {})) {
+        for (const [vlanName, vlan] of RouterOsRender.entries(this.device.switching?.vlans)) {
             const routedHere = this.declaredVlanInterfaces().some(([, iface]) => iface.vlan === vlanName);
             const trunks = this.switched()
                 .filter(([, settings]) => settings.trunk_vlans?.includes(vlanName))
@@ -702,7 +704,7 @@ export class RouterOsRender {
         const lldp = this.lldpMembers();
         if (lldp) lists.set("lldp", lldp);
 
-        const native = this.device.management?.native?.interfaces;
+        const native = this.device.management?.native_protocol?.interfaces;
         if (native)
             lists.set(
                 "native",
@@ -722,7 +724,7 @@ export class RouterOsRender {
      * Where LLDP runs, when it is limited to some ports. Undefined when it runs everywhere or nowhere, which the discovery settings say directly.
      */
     private lldpMembers(): string[] | undefined {
-        const lldp = this.device.lldp;
+        const lldp = this.device.switching?.lldp;
         if (!lldp) return undefined;
 
         const overridden = Object.entries(this.ports).filter(([, port]) => port.lldp !== undefined);
@@ -741,7 +743,7 @@ export class RouterOsRender {
 
     /** A VRF lists its interfaces. */
     private vrfs(): void {
-        for (const [vrf, settings] of Object.entries(this.device.vrfs ?? {})) {
+        for (const [vrf, settings] of RouterOsRender.entries(this.device.routing?.vrfs)) {
             const members = this.routed()
                 .filter(({ settings: iface }) => iface.vrf === vrf)
                 .map(({ name }) => name);
@@ -762,7 +764,7 @@ export class RouterOsRender {
             for (const entry of settings.addresses ?? []) {
                 const address = typeof entry === "string" ? entry : entry.address;
                 // The far end of a point-to-point address, which the platform calls its network.
-                const peer = typeof entry === "string" ? undefined : entry.peer;
+                const peer = typeof entry === "string" ? undefined : entry.peer_address;
 
                 if (Address.family(address) === "ipv4") {
                     this.add("/ip address", "add", { address, comment: settings.description, interface: name, network: peer });
@@ -795,7 +797,7 @@ export class RouterOsRender {
     }
 
     private dhcp(): void {
-        for (const [name, server] of Object.entries(this.device.dhcp ?? {})) {
+        for (const [name, server] of Object.entries(this.device.services?.dhcp_server ?? {})) {
             const [first, last] = server.pool;
             // The pool shares the server's name.
             this.add("/ip pool", "add", { name, ranges: `${first}-${last}` });
@@ -821,14 +823,17 @@ export class RouterOsRender {
             }
         }
 
-        for (const [name, relay] of Object.entries(this.device.dhcp_relay ?? {})) {
+        for (const [name, relay] of Object.entries(this.device.services?.dhcp_relay ?? {})) {
             this.add("/ip dhcp-relay", "add", { "dhcp-server": relay.servers.join(","), interface: this.name(relay.interface), name });
         }
     }
 
     private dns(): void {
-        const dns = this.device.system?.dns;
-        this.add("/ip dns", "set", { "allow-remote-requests": RouterOsRender.yesNo(dns?.serve), servers: dns?.servers.join(",") ?? "" });
+        const servers = this.device.system?.dns?.servers;
+        this.add("/ip dns", "set", {
+            "allow-remote-requests": RouterOsRender.yesNo(this.device.services?.dns_server),
+            servers: servers?.join(",") ?? "",
+        });
     }
 
     /**
@@ -840,16 +845,17 @@ export class RouterOsRender {
         const { device } = this;
         const entries: { list: string; address: string }[] = [];
 
-        for (const [list, members] of Object.entries(device.firewall?.address_sets ?? {})) {
+        for (const [list, members] of RouterOsRender.entries(device.firewall?.address_sets)) {
             for (const address of members) entries.push({ list, address });
         }
 
-        for (const [list, set] of Object.entries(device.prefix_sets ?? {})) {
-            if ("prefixes" in set) for (const address of set.prefixes) entries.push({ list, address });
+        for (const [list] of RouterOsRender.entries(device.routing?.prefix_sets)) {
+            const prefixes = RouterOsRender.prefixesOf(device, list);
+            if (prefixes) for (const address of prefixes) entries.push({ list, address });
             else this.addLine("/ip firewall address-list", `# generated ${list}`);
         }
 
-        for (const prefix of device.routing?.bgp?.networks ?? []) {
+        for (const prefix of device.routing?.bgp?.originated_prefixes ?? []) {
             entries.push({ list: RouterOsRender.NETWORKS[Address.family(Address.host(prefix))], address: prefix });
         }
 
@@ -918,12 +924,13 @@ export class RouterOsRender {
     /** Every address NAT translates to or from: each translation's target, and the address a destination translation matches. Once each, in rule order. */
     static natAddresses(device: Device): string[] {
         const nat = device.firewall?.nat;
+        const translatedTo = (rule: NatRule) => (rule.then === "masquerade" ? [] : [Address.host(rule.to_address)]);
         const addresses = [
-            ...(nat?.source ?? []).flatMap((rule) => (rule.action === "masquerade" ? [] : [rule.to])),
-            ...(nat?.destination ?? []).flatMap((rule) => [
-                ...(rule.match?.dst ? [rule.match.dst] : []),
-                ...(rule.action === "masquerade" ? [] : [rule.to]),
-            ]),
+            ...(nat?.source ?? []).flatMap(translatedTo),
+            ...(nat?.destination ?? []).flatMap((rule) => {
+                const matched = RouterOsRender.one(rule.if?.dst);
+                return [...(matched ? [matched] : []), ...translatedTo(rule)];
+            }),
         ];
 
         return [...new Set(addresses)];
@@ -934,9 +941,9 @@ export class RouterOsRender {
      *
      * A rule naming an address set applies only to the families the set has members in.
      */
-    private families(match: FilterMatch<string, string> | undefined): Family[] {
+    private families(match: FilterMatch | undefined): Family[] {
         const sets = this.device.firewall?.address_sets ?? {};
-        const address = match?.src ?? match?.dst;
+        const address = RouterOsRender.one(match?.src) ?? RouterOsRender.one(match?.dst);
 
         let candidates: Family[] = ["ipv4", "ipv6"];
         if (match?.family) candidates = [match.family];
@@ -944,25 +951,27 @@ export class RouterOsRender {
 
         const setHas = (set: string | undefined, family: Family) =>
             !set || (sets[set] ?? []).some((member) => Address.family(member) === family);
-        return candidates.filter((family) => setHas(match?.src_set, family) && setHas(match?.dst_set, family));
+        return candidates.filter((family) => setHas(match?.src_address_set, family) && setHas(match?.dst_address_set, family));
     }
 
     /** The match properties of a rule, as the platform names them. */
-    private matchProperties(match: FilterMatch<string, string> | undefined, family: Family) {
+    private matchProperties(match: FilterMatch | undefined, family: Family) {
         const protocol = match?.protocol === "icmp" && family === "ipv6" ? "icmpv6" : match?.protocol;
         const setFlags = match?.tcp_flags?.set ?? [];
         const unsetFlags = (match?.tcp_flags?.unset ?? []).map((flag) => `!${flag}`);
         const flags = match?.tcp_flags ? [...setFlags, ...unsetFlags].join(",") : undefined;
+        const inInterface = RouterOsRender.one(match?.in_interface);
+        const outInterface = RouterOsRender.one(match?.out_interface);
         return {
-            "connection-state": match?.state?.join(","),
-            "dst-address": match?.dst,
-            "dst-address-list": match?.dst_set,
+            "connection-state": match?.connection_state?.join(","),
+            "dst-address": RouterOsRender.one(match?.dst),
+            "dst-address-list": match?.dst_address_set,
             "dst-port": RouterOsRender.portList(match?.dst_port),
-            "in-interface": match?.in_interface && this.name(match.in_interface),
-            "out-interface": match?.out_interface && this.name(match.out_interface),
+            "in-interface": inInterface && this.name(inInterface),
+            "out-interface": outInterface && this.name(outInterface),
             protocol,
-            "src-address": match?.src,
-            "src-address-list": match?.src_set,
+            "src-address": RouterOsRender.one(match?.src),
+            "src-address-list": match?.src_address_set,
             "src-port": RouterOsRender.portList(match?.src_port),
             "tcp-flags": flags,
         };
@@ -976,47 +985,49 @@ export class RouterOsRender {
             if (!settings) continue;
 
             for (const rule of settings.rules ?? []) {
-                if (!this.families(rule.match).includes(family)) continue;
+                if (!this.families(rule.if).includes(family)) continue;
 
-                const match = this.matchProperties(rule.match, family);
+                const match = this.matchProperties(rule.if, family);
                 // The platform's fast path takes a flow only on IPv4. The accept below still applies on both.
-                if (rule.offload && family === "ipv4") {
+                if (rule.fast_path && family === "ipv4") {
                     this.add(menu, "add", { action: "fasttrack-connection", chain, comment: rule.description, ...match });
                 }
 
-                this.add(menu, "add", { action: rule.action, chain, comment: rule.description, ...match });
+                this.add(menu, "add", { action: rule.then, chain, comment: rule.description, ...match });
             }
 
-            if (settings.default === "drop") this.add(menu, "add", { action: "drop", chain, comment: "Default" });
+            if (settings.default_action === "drop") this.add(menu, "add", { action: "drop", chain, comment: "Default" });
         }
     }
 
     private nat(family: Family): void {
         const menu = family === "ipv4" ? "/ip firewall nat" : "/ipv6 firewall nat";
-        const chains: [string, readonly NatRule<string, string>[] | undefined][] = [
+        const chains: [string, readonly NatRule[] | undefined][] = [
             ["srcnat", this.device.firewall?.nat?.source],
             ["dstnat", this.device.firewall?.nat?.destination],
         ];
 
         for (const [chain, rules] of chains) {
             for (const rule of rules ?? []) {
-                if (!this.families(rule.match).includes(family)) continue;
+                if (!this.families(rule.if).includes(family)) continue;
                 // A translation to an address belongs to that address's family.
-                if (rule.action !== "masquerade" && Address.family(rule.to) !== family) continue;
+                if (rule.then !== "masquerade" && Address.family(rule.to_address) !== family) continue;
 
                 const action =
-                    rule.action === "masquerade"
-                        ? {
-                              action: "masquerade",
-                          }
-                        : { action: rule.action === "snat" ? "src-nat" : "dst-nat", "to-addresses": rule.to, "to-ports": rule.to_port };
-                this.add(menu, "add", { ...action, chain, comment: rule.description, ...this.matchProperties(rule.match, family) });
+                    rule.then === "masquerade"
+                        ? { action: "masquerade" }
+                        : {
+                              action: rule.then === "snat" ? "src-nat" : "dst-nat",
+                              "to-addresses": Address.host(rule.to_address),
+                              "to-ports": rule.to_port,
+                          };
+                this.add(menu, "add", { ...action, chain, comment: rule.description, ...this.matchProperties(rule.if, family) });
             }
         }
     }
 
     private helpers(): void {
-        const enabled = this.device.firewall?.helpers ?? [];
+        const enabled = this.device.firewall?.conntrack_helpers ?? [];
 
         for (const helper of RouterOsRender.HELPERS) {
             this.add("/ip firewall service-port", `set ${helper}`, { disabled: RouterOsRender.yesNo(!enabled.includes(helper)) });
@@ -1028,23 +1039,26 @@ export class RouterOsRender {
      */
     private switchAcls(): void {
         for (const { port, rule, srcPort, dstPort } of RouterOsRender.switchRules(this.device)) {
-            const match = rule.match ?? {};
-            const ipv6 = match.family === "ipv6" || [match.src, match.dst].some((address) => address && Address.family(address) === "ipv6");
+            const match = rule.if ?? {};
+            const src = RouterOsRender.one(match.src);
+            const dst = RouterOsRender.one(match.dst);
+            const vlan = RouterOsRender.one(match.vlan);
+            const ipv6 = match.family === "ipv6" || [src, dst].some((address) => address && Address.family(address) === "ipv6");
             const address = (prefix: string | undefined) => (prefix && !ipv6 ? RouterOsRender.dottedMask(prefix) : prefix);
 
             this.add("/interface ethernet switch rule", "add", {
                 comment: rule.description,
-                [ipv6 ? "dst-address6" : "dst-address"]: address(match.dst),
+                [ipv6 ? "dst-address6" : "dst-address"]: address(dst),
                 "dst-port": dstPort,
                 "mac-protocol": ipv6 ? "ipv6" : "ip",
-                "new-dst-ports": rule.action === "drop" ? "" : undefined,
+                "new-dst-ports": rule.then === "drop" ? "" : undefined,
                 ports: this.name(port),
                 protocol: match.protocol,
                 rate: rule.rate && RouterOsRender.bitrate(rule.rate),
-                [ipv6 ? "src-address6" : "src-address"]: address(match.src),
+                [ipv6 ? "src-address6" : "src-address"]: address(src),
                 "src-port": srcPort,
                 switch: "switch1",
-                "vlan-id": match.vlan && this.vlanId(match.vlan),
+                "vlan-id": vlan && this.vlanId(vlan),
             });
         }
 
@@ -1078,9 +1092,7 @@ export class RouterOsRender {
 
     /** The ports with an ethertype filter, with the kinds each takes. Each makes one switch rule per kind and one more. */
     static ethertypeFilters(device: Device): { port: string; ethertypes: readonly Ethertype[] }[] {
-        return Object.entries(device.ports ?? {}).flatMap(([port, settings]) =>
-            settings?.ethertypes ? [{ port, ethertypes: settings.ethertypes }] : []
-        );
+        return Derive.ports(device).flatMap(([port, settings]) => (settings.ethertypes ? [{ port, ethertypes: settings.ethertypes }] : []));
     }
 
     /** Every switch rule the device's hardware ACLs make, in order: one for each port with an ACL, each rule of it, and each source and destination port or range of the rule. */
@@ -1088,12 +1100,12 @@ export class RouterOsRender {
         const each = (ports: Ports | undefined) => (ports === undefined ? [undefined] : RouterOsRender.eachPort(ports));
         const rules: SwitchRule[] = [];
 
-        for (const [port, settings] of Object.entries(device.ports ?? {})) {
-            if (!settings?.acl) continue;
+        for (const [port, settings] of Derive.ports(device)) {
+            if (!settings.ingress_acl) continue;
 
-            for (const rule of device.acls?.[settings.acl] ?? []) {
-                for (const srcPort of each(rule.match?.src_port)) {
-                    for (const dstPort of each(rule.match?.dst_port)) rules.push({ port, rule, srcPort, dstPort });
+            for (const rule of device.switching?.acls?.[settings.ingress_acl] ?? []) {
+                for (const srcPort of each(rule.if?.src_port)) {
+                    for (const dstPort of each(rule.if?.dst_port)) rules.push({ port, rule, srcPort, dstPort });
                 }
             }
         }
@@ -1118,37 +1130,38 @@ export class RouterOsRender {
 
     /** A table beside the main one. `fib` puts its routes in the forwarding table, so traffic can be routed by them. */
     private routingTables(): void {
-        for (const [name, table] of Object.entries(this.device.routing?.tables ?? {})) {
+        for (const [name, table] of RouterOsRender.entries(this.device.routing?.tables)) {
             this.add("/routing table", "add fib", { comment: table.description, name });
         }
     }
 
     /** Rules in the order written. `lookup-only-in-table` drops what the table has no route for, and `lookup` falls back to the main table. */
     private routingRules(): void {
-        for (const rule of this.device.routing?.rules ?? []) {
-            const onlyInTable = rule.table !== "main" && (rule.fallback ?? "none") === "none";
+        for (const rule of this.device.routing?.policy_routing ?? []) {
+            const onlyInTable = rule.routing_table !== "main" && (rule.fallback ?? "none") === "none";
             this.add("/routing rule", "add", {
                 action: onlyInTable ? "lookup-only-in-table" : "lookup",
                 comment: rule.description,
                 "dst-address": rule.match?.dst,
                 interface: rule.match?.in_interface && this.name(rule.match.in_interface),
                 "src-address": rule.match?.src,
-                table: rule.table,
+                table: rule.routing_table,
             });
         }
     }
 
     private staticRoutes(): void {
-        for (const route of this.device.routing?.static ?? []) {
+        for (const route of this.device.routing?.static_routes ?? []) {
             const menu = Address.family(Address.host(route.prefix)) === "ipv4" ? "/ip route" : "/ipv6 route";
             const verb = route.blackhole ? "add blackhole" : "add";
-            const gateway = route.via ?? (route.interface ? this.name(route.interface) : undefined);
+            const nextHop = route.next_hop && Address.host(route.next_hop);
+            const gateway = nextHop ?? (route.interface ? this.name(route.interface) : undefined);
             this.add(menu, verb, {
                 comment: route.description,
                 distance: route.distance,
                 "dst-address": route.prefix,
                 gateway,
-                "routing-table": route.vrf ?? Utils.otherTable(route.table),
+                "routing-table": route.vrf ?? Utils.otherTable(route.routing_table),
             });
         }
     }
@@ -1171,28 +1184,28 @@ export class RouterOsRender {
     }
 
     /** A neighbor's settings with its group's beneath them. */
-    private settingsOf(neighbor: AnyNeighbor): NeighborSettings<string, string> {
-        const group = neighbor.group ? this.device.routing?.bgp?.groups?.[neighbor.group] : undefined;
+    private settingsOf(neighbor: Neighbor): NeighborSettings {
+        const group = neighbor.neighbor_group ? this.device.routing?.bgp?.neighbor_groups?.[neighbor.neighbor_group] : undefined;
         return { ...group, ...neighbor };
     }
 
     /** The families a neighbor exchanges: the ones it states, or its address's. */
-    private familiesOf(neighbor: AnyNeighbor): readonly Family[] {
-        return this.settingsOf(neighbor).families ?? [Address.family(neighbor.address)];
+    private familiesOf(neighbor: Neighbor): readonly Family[] {
+        return this.settingsOf(neighbor).address_families ?? [Address.family(neighbor.address)];
     }
 
     /** Does a rule belong on a family's chain? A rule naming a prefix, a family, or a prefix set of one family belongs only there. */
-    private appliesTo(rule: AnyRule, family: Family): boolean {
-        const match = rule.match;
+    private appliesTo(rule: PolicyRule, family: Family): boolean {
+        const match = RouterOsRender.onRoutes(rule) ? rule.if : undefined;
         if (match?.family && match.family !== family) return false;
 
         if (match?.prefix && Address.family(Address.host(match.prefix)) !== family) return false;
 
         if (match?.prefix_set) {
-            const set = this.device.prefix_sets?.[match.prefix_set];
+            const set = this.device.routing?.prefix_sets?.[match.prefix_set];
             if (!set) return false;
 
-            const firstPrefix = "source" in set ? undefined : set.prefixes[0];
+            const firstPrefix = RouterOsRender.prefixesOf(this.device, match.prefix_set)?.[0];
             const setFamily = "source" in set ? set.source.family : firstPrefix && Address.family(Address.host(firstPrefix));
             if (setFamily !== family) return false;
         }
@@ -1207,7 +1220,7 @@ export class RouterOsRender {
      */
     private policies(): void {
         const bgp = this.device.routing!.bgp!;
-        const policies = this.device.policies ?? {};
+        const policies = this.device.routing?.policies ?? {};
 
         const wanted = new Map<string, Set<Family>>();
         const want = (policy: string, family: Family) => {
@@ -1225,14 +1238,14 @@ export class RouterOsRender {
             const settings = this.settingsOf(neighbor);
 
             for (const family of this.familiesOf(neighbor)) {
-                for (const policy of [settings.import, settings.export]) {
+                for (const policy of [settings.import_policy, settings.export_policy]) {
                     if (policy) want(policy, family);
                     else rejectAllNeeded = true;
                 }
             }
         }
 
-        const called = new Set(Object.values(policies).flatMap((rules) => rules.flatMap((rule) => (rule.call ? [rule.call] : []))));
+        const called = new Set(Object.values(policies).flatMap((rules) => (rules ?? []).flatMap((rule) => (rule.call ? [rule.call] : []))));
 
         for (const policy of [...wanted.keys()].sort()) {
             for (const family of ["ipv4", "ipv6"] as const) {
@@ -1243,11 +1256,12 @@ export class RouterOsRender {
 
                 for (const rule of rules) {
                     const text = RouterOsRender.ruleText(rule, family);
-                    if (text) this.add("/routing filter rule", "add", { chain, comment: rule.description, rule: text });
+                    const comment = RouterOsRender.onRoutes(rule) ? rule.description : undefined;
+                    if (text) this.add("/routing filter rule", "add", { chain, comment, rule: text });
                 }
 
                 const last = rules.at(-1);
-                const decides = last !== undefined && !last.match && !last.call && last.action !== undefined;
+                const decides = last !== undefined && RouterOsRender.onRoutes(last) && !last.if && last.then !== undefined;
                 if (!called.has(policy) && !decides) this.add("/routing filter rule", "add", { chain, rule: "reject" });
             }
         }
@@ -1270,7 +1284,7 @@ export class RouterOsRender {
             const [family] = this.familiesOf(neighbor) as [Family];
             const addressFamily = Address.family(neighbor.address);
             const internal = settings.remote_as === bgp.asn;
-            const originates = bgp.networks?.some((prefix) => Address.family(Address.host(prefix)) === family);
+            const originates = bgp.originated_prefixes?.some((prefix) => Address.family(Address.host(prefix)) === family);
             const role = settings.role ? RouterOsRender.ROLES[settings.role] : internal ? "ibgp" : "ebgp";
 
             this.add("/routing bgp connection", "add", {
@@ -1279,21 +1293,21 @@ export class RouterOsRender {
                 as: bgp.asn,
                 connect: settings.passive ? "no" : undefined,
                 "hold-time": settings.hold_time ? RouterOsRender.duration(settings.hold_time) : undefined,
-                "input.filter": RouterOsRender.chainName(settings.import ?? RouterOsRender.REJECT_ALL, family),
+                "input.filter": RouterOsRender.chainName(settings.import_policy ?? RouterOsRender.REJECT_ALL, family),
                 // The one instance bgpInstance adds. 7.23 refuses a new connection without it.
                 instance: "default",
                 [`input.limit-process-routes-${family}`]: settings.max_prefixes,
                 "keepalive-time": settings.keepalive ? RouterOsRender.duration(settings.keepalive) : undefined,
                 listen: settings.passive ? "yes" : undefined,
-                "local.address": settings.local_address,
+                "local.address": settings.local_address && Address.host(settings.local_address),
                 "local.role": role,
                 multihop: settings.multihop ? "yes" : undefined,
                 name,
-                "output.filter-chain": RouterOsRender.chainName(settings.export ?? RouterOsRender.REJECT_ALL, family),
+                "output.filter-chain": RouterOsRender.chainName(settings.export_policy ?? RouterOsRender.REJECT_ALL, family),
                 "output.network": originates ? RouterOsRender.NETWORKS[family] : undefined,
                 "remote.address": `${neighbor.address}/${addressFamily === "ipv4" ? 32 : 128}`,
                 "remote.as": settings.remote_as,
-                "routing-table": Utils.otherTable(settings.table),
+                "routing-table": Utils.otherTable(settings.routing_table),
                 "tcp-md5-key": settings.password && Secrets.marker(settings.password),
                 "use-bfd": settings.bfd ? "yes" : undefined,
             });
@@ -1305,7 +1319,7 @@ export class RouterOsRender {
         const ospf = this.device.routing?.ospf;
         if (!ospf) return;
 
-        for (const family of ospf.families ?? ["ipv4"]) {
+        for (const family of ospf.address_families ?? ["ipv4"]) {
             const version = family === "ipv4" ? 2 : 3;
             const instance = `ospf-v${version}`;
             this.add("/routing ospf instance", "add", {
@@ -1367,6 +1381,12 @@ export class RouterOsRender {
         this.certificates();
     }
 
+    /** The sources a service takes: its own, or `management.allow`. `unsupported()` refuses an address set named there. */
+    private allowed(own: readonly Prefix[] | undefined): readonly string[] {
+        const shared = this.device.management?.allow;
+        return own ?? (typeof shared === "string" ? [] : shared) ?? [];
+    }
+
     /** Every service the platform has is stated. One the config does not name is disabled. */
     private services(): void {
         const management = this.device.management ?? {};
@@ -1378,7 +1398,7 @@ export class RouterOsRender {
                 continue;
             }
 
-            const allow = service.allow ?? management.allow ?? [];
+            const allow = this.allowed(service.allow);
             this.add("/ip service", `set ${platform}`, {
                 address: allow.join(","),
                 certificate: service.certificate,
@@ -1394,7 +1414,7 @@ export class RouterOsRender {
 
     /** What works at layer 2: the platform's client over MAC, MAC ping, the bandwidth test server and neighbor discovery. */
     private layerTwo(): void {
-        const nativeList = this.device.management?.native?.interfaces ? "native" : "none";
+        const nativeList = this.device.management?.native_protocol?.interfaces ? "native" : "none";
         this.add("/tool mac-server", "set", { "allowed-interface-list": nativeList });
         this.add("/tool mac-server mac-winbox", "set", { "allowed-interface-list": nativeList });
         this.add("/tool mac-server ping", "set", { enabled: "no" });
@@ -1402,7 +1422,7 @@ export class RouterOsRender {
 
         let discovery = "none";
         if (this.lldpMembers()) discovery = "lldp";
-        else if (this.device.lldp) discovery = "all";
+        else if (this.device.switching?.lldp) discovery = "all";
         this.add("/ip neighbor discovery-settings", "set", { "discover-interface-list": discovery, protocol: "lldp" });
     }
 
@@ -1410,8 +1430,7 @@ export class RouterOsRender {
      * The platform keeps one community it will not delete. With version 2c it becomes the read community; without, it is disabled. Version 3 users are communities of their own.
      */
     private snmp(): void {
-        const management = this.device.management ?? {};
-        const snmp = management.snmp;
+        const snmp = this.device.monitoring?.snmp;
 
         if (!snmp) {
             this.add("/snmp", "set", { enabled: "no" });
@@ -1419,7 +1438,7 @@ export class RouterOsRender {
             return;
         }
 
-        const allow = (snmp.allow ?? management.allow ?? []).join(",");
+        const allow = this.allowed(snmp.allow).join(",");
         this.add("/snmp", "set", { contact: snmp.contact ?? "", enabled: "yes", location: snmp.location ?? "" });
 
         if (snmp.community)
@@ -1430,7 +1449,8 @@ export class RouterOsRender {
             this.add("/snmp community", "add", {
                 addresses: allow,
                 "authentication-password": Secrets.marker(user.auth_password),
-                "authentication-protocol": RouterOsRender.SNMP_AUTH[user.auth],
+                // SHA1 only: unsupported() refuses sha256, so it is never written as SHA1.
+                "authentication-protocol": "SHA1",
                 "encryption-password": Secrets.marker(user.privacy_password),
                 "encryption-protocol": RouterOsRender.SNMP_PRIVACY[user.privacy],
                 name,
@@ -1440,7 +1460,7 @@ export class RouterOsRender {
     }
 
     private users(): void {
-        for (const [name, user] of Object.entries(this.device.users ?? {})) {
+        for (const [name, user] of RouterOsRender.entries(this.device.system?.users)) {
             this.add("/user", "add", {
                 comment: user.description,
                 group: RouterOsRender.USER_GROUPS[user.role],
@@ -1455,9 +1475,9 @@ export class RouterOsRender {
      * Certificates are not part of an export, so the reader lists them in this same form: a name, the SHA-256 fingerprint of the certificate, and whether the device holds its private key. A difference is installed from the config, not edited.
      */
     private certificates(): void {
-        for (const [name, certificate] of Object.entries(this.device.certificates ?? {})) {
+        for (const [name, certificate] of RouterOsRender.entries(this.device.system?.certificates)) {
             this.add("/certificate", "add", {
-                fingerprint: RouterOsRender.fingerprint(certificate.certificate),
+                fingerprint: RouterOsRender.fingerprint(Utils.projectFile(certificate.certificate_file)),
                 name,
                 "private-key": RouterOsRender.yesNo(Boolean(certificate.private_key)),
             });
@@ -1468,8 +1488,8 @@ export class RouterOsRender {
         const system = this.device.system ?? {};
 
         this.add("/ip settings", "set", {
-            "send-redirects": RouterOsRender.yesNo(system.ip?.icmp_redirects),
-            "tcp-syncookies": RouterOsRender.yesNo(system.ip?.syn_cookies),
+            "send-redirects": RouterOsRender.yesNo(system.ip_stack?.icmp_redirects),
+            "tcp-syncookies": RouterOsRender.yesNo(system.ip_stack?.syn_cookies),
         });
         this.add("/system identity", "set", { name: this.device.name });
 
@@ -1478,7 +1498,7 @@ export class RouterOsRender {
         this.add("/system note", "set", { note: system.banner ?? "", "show-at-login": "yes" });
 
         this.add("/system ntp client", "set", { enabled: RouterOsRender.yesNo(Boolean(system.ntp?.servers.length)) });
-        this.add("/system ntp server", "set", { enabled: RouterOsRender.yesNo(system.ntp?.serve) });
+        this.add("/system ntp server", "set", { enabled: RouterOsRender.yesNo(this.device.services?.ntp_server) });
         for (const server of system.ntp?.servers ?? []) this.add("/system ntp client servers", "add", { address: server });
 
         this.logging();
@@ -1490,10 +1510,9 @@ export class RouterOsRender {
         this.flowExport();
     }
 
-    /** Local logging uses the platform's built-in disk action, number 1. Each remote collector gets an action of its own. */
+    /** Local logging uses the platform's built-in disk action, number 1. Each syslog collector gets an action of its own. */
     private logging(): void {
-        const logging = this.device.system?.logging;
-        const local = logging?.local;
+        const local = this.device.system?.logging?.local;
 
         this.add("/system logging action", "set 1", {
             "disk-file-count": local?.files ?? 2,
@@ -1503,7 +1522,7 @@ export class RouterOsRender {
             this.add("/system logging", "add", { action: "disk", topics: topic });
         }
 
-        (logging?.remote ?? []).forEach((collector, index) => {
+        (this.device.monitoring?.syslog ?? []).forEach((collector, index) => {
             const action = `remote${index + 1}`;
             this.add("/system logging action", "add", {
                 name: action,
@@ -1517,7 +1536,7 @@ export class RouterOsRender {
 
     /** NetFlow version 9 and IPFIX through traffic flow. The platform has no sFlow, which `unsupported()` reports. */
     private flowExport(): void {
-        const flow = this.device.flow_export;
+        const flow = this.device.monitoring?.flow_export;
         if (!flow) {
             this.add("/ip traffic-flow", "set", { enabled: "no" });
             return;