@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/src/platforms/vrp/TRAPS.md

@@ -22,7 +22,7 @@ Behaviour that looks like something else. Each one has been hit on a CE6855 runn
 - `vlan batch` has every VLAN on one line, and undoing a list that includes a VLAN with an L3 interface is refused. A change sends only the VLANs added and `undo vlan batch` for the ones removed.
 - A VLAN name is unique across VLANs: a new VLAN cannot take a name another still has. VLANs no longer used, and their VLAN interfaces, are removed first, in the same candidate.
 - `undo ssh server key-exchange <algorithms>` is refused with "Too many parameters"; `undo ssh server key-exchange` takes none. `hmac` was proved the same way. `cipher` is undone the same way but was not proved on its own.
-- A console on a password only (`passwordOnly`) shows `Please Press ENTER.` after a logout or a refused password, and `Error: The password is invalid.` for a wrong one.
+- A console on a password only (`password_only`) shows `Please Press ENTER.` after a logout or a refused password, and `Error: The password is invalid.` for a wrong one.
 - Once SNMP is on, the switch prints an engine ID of its own, `snmp-agent local-engineid`, derived from its MAC, and prints each SNMPv3 user as a bare `snmp-agent usm-user v3 <name>` line before its settings. Planning against either as unrendered would undo the user; seen on a CE6855 on V200R005C00SPC800.
 - `apply --secrets` sends every line holding a secret again, the local users' passwords included, and a password among the user's last ten is refused, which discards the whole candidate. Send it only when a password changed.
 - An SNMPv3 key prints as `cipher %^%#...%^%#`, which can be turned back into the key. The read redacts every value after `cipher`, as it does a password.

package/src/platforms/vrp/index.ts

@@ -6,7 +6,7 @@ import type { Client, ClientChannel } from "ssh2";
 import { Address } from "../../core/address";
 import type { Neighbor } from "../../core/cabling";
 import { Secrets } from "../../core/secrets";
-import type { Device } from "../../schema";
+import type { Device, Lag, VlanInterface } from "../../model";
 import { ConsoleShell, SerialConsole, type ConsoleDialect } from "../../transport/console";
 import { Ssh } from "../../transport/ssh";
 import { Catalog } from "../catalog";
@@ -106,46 +106,53 @@ export class Vrp extends Platform {
 
         if (device.management?.interfaces) found.push("management.interfaces, which only FortiOS builds for now");
 
-        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-            if (iface.type === "bridge") found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
-            if (iface.type === "vlan" && iface.mac) found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
-        }
+        const interfaces = Derive.interfaces(device);
 
-        for (const [name, port] of Object.entries(device.ports ?? {})) {
-            if (!port) continue;
+        for (const { name, kind, settings } of interfaces) {
+            if (kind === "bridge") found.push(`interfaces.bridge.${name}, a bridge, which only FortiOS builds for now`);
+            if (kind === "vlan_interface" && (settings as VlanInterface).mac)
+                found.push(`interfaces.vlan_interface.${name}.mac, which only RouterOS sets for now`);
+        }
 
-            for (const field of ["speed", "acl", "mtu", "addresses", "vrrp", "vrf"] as const) {
-                if (port[field] !== undefined) found.push(`ports.${name}.${field}, ports are switched; use a VLAN interface`);
+        for (const [name, port] of Derive.ports(device)) {
+            for (const field of ["speed", "ingress_acl", "mtu", "addresses", "vrrp", "vrf", "ipv6_ra", "hardware_offload"] as const) {
+                if (port[field] !== undefined) found.push(`interfaces.ethernet.${name}.${field}, ports are switched; use a VLAN interface`);
             }
 
             for (const field of ["mac_limit", "ethertypes"] as const) {
-                if (port[field] !== undefined && port.lag) found.push(`ports.${name}.${field} on a LAG member, set it on the LAG`);
+                if (port[field] !== undefined && port.in_lag)
+                    found.push(`interfaces.ethernet.${name}.${field} on a LAG member, set it on the LAG`);
             }
 
-            if (port.lldp === true && !device.lldp) found.push(`ports.${name}.lldp true while LLDP is off on the device`);
+            if (port.lldp === true && !device.switching?.lldp)
+                found.push(`interfaces.ethernet.${name}.lldp true while LLDP is off on the device`);
             const storm = Object.values(port.storm_control ?? {});
-            if (storm.some((threshold) => "pps" in threshold)) found.push(`ports.${name}.storm_control in pps, the platform takes percent`);
+            if (storm.some((threshold) => "pps" in threshold))
+                found.push(`interfaces.ethernet.${name}.storm_control in pps, the platform takes percent`);
         }
 
-        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-            if (iface.type !== "vlan" && iface.type !== "lag") found.push(`interfaces.${name}, a ${iface.type}`);
-            if (iface.type === "lag" && iface.addresses?.length) found.push(`interfaces.${name}.addresses, LAGs are switched`);
-            if (iface.type === "lag" && iface.mac_limit !== undefined) found.push(`interfaces.${name}.mac_limit, on a LAG is not proved`);
-            if (iface.type === "lag" && iface.ethertypes) found.push(`interfaces.${name}.ethertypes, on a LAG is not proved`);
-            if (iface.mtu !== undefined) found.push(`interfaces.${name}.mtu`);
-            if (iface.ipv6_ra) found.push(`interfaces.${name}.ipv6_ra`);
-            for (const group of iface.vrrp ?? [])
-                if (Address.family(group.address) === "ipv6") found.push(`interfaces.${name}.vrrp for IPv6`);
+        for (const { name, kind, settings } of interfaces) {
+            const where = `interfaces.${kind}.${name}`;
+            if (kind !== "vlan_interface" && kind !== "lag") found.push(`${where}, a ${kind}`);
+            if (kind === "lag" && settings.addresses?.length) found.push(`${where}.addresses, LAGs are switched`);
+            if (kind === "lag" && (settings as Lag).mac_limit !== undefined) found.push(`${where}.mac_limit, on a LAG is not proved`);
+            if (kind === "lag" && (settings as Lag).ethertypes) found.push(`${where}.ethertypes, on a LAG is not proved`);
+            if (settings.mtu !== undefined) found.push(`${where}.mtu`);
+            if (settings.ipv6_ra) found.push(`${where}.ipv6_ra`);
+            if (settings.hardware_offload !== undefined) found.push(`${where}.hardware_offload, the switch chip forwards everything`);
+            for (const group of settings.vrrp ?? []) if (Address.family(group.address) === "ipv6") found.push(`${where}.vrrp for IPv6`);
         }
 
-        for (const [name, vrf] of Object.entries(device.vrfs ?? {})) {
-            if (vrf.description) found.push(`vrfs.${name}.description`);
+        const routing = device.routing;
+
+        for (const [name, vrf] of Object.entries(routing?.vrfs ?? {})) {
+            if (vrf?.description) found.push(`routing.vrfs.${name}.description`);
         }
 
-        const routing = device.routing;
         if (routing?.bgp) found.push("routing.bgp");
         if (routing?.rpki) found.push("routing.rpki");
-        if (routing?.ospf?.families?.includes("ipv6")) found.push("routing.ospf for IPv6");
+        if (routing?.ospf?.address_families?.includes("ipv6")) found.push("routing.ospf for IPv6");
+        if (routing?.router_id && !routing.ospf) found.push("routing.router_id without routing.ospf, only OSPF uses it here");
 
         const bfd = routing?.bfd;
         if (bfd && !(Number.isInteger(bfd.interval) && bfd.interval >= 50 && bfd.interval <= 1000))
@@ -153,46 +160,59 @@ export class Vrp extends Platform {
         if (bfd && !(Number.isInteger(bfd.multiplier) && bfd.multiplier >= 3 && bfd.multiplier <= 50))
             found.push("routing.bfd.multiplier, between 3 and 50 on the platform");
 
-        for (const route of routing?.static ?? []) {
+        for (const route of routing?.static_routes ?? []) {
             if (!route.bfd) continue;
 
-            const where = `routing.static ${route.prefix} bfd`;
+            const where = `routing.static_routes ${route.prefix} bfd`;
+            const nextHop = route.next_hop && Address.host(route.next_hop);
             if (route.vrf) found.push(`${where} in a VRF, not proved`);
-            else if (!route.via || Address.family(route.via) !== "ipv4") found.push(`${where}, needs an IPv4 via`);
-            else if (!VrpRender.localAddressTo(device, route.via))
-                found.push(`${where}, the device has no address on the network of ${route.via}`);
+            else if (!nextHop || Address.family(nextHop) !== "ipv4") found.push(`${where}, needs an IPv4 next_hop`);
+            else if (!VrpRender.localAddressTo(device, nextHop))
+                found.push(`${where}, the device has no address on the network of ${nextHop}`);
         }
 
-        for (const [index, route] of (routing?.static ?? []).entries()) {
+        for (const [index, route] of (routing?.static_routes ?? []).entries()) {
             if (route.description && Address.family(Address.split(route.prefix).addr) === "ipv6")
-                found.push(`routing.static[${index}].description for IPv6`);
+                found.push(`routing.static_routes[${index}].description for IPv6`);
         }
 
-        for (const field of ["firewall", "dhcp", "acls", "policies", "prefix_sets", "hardware_offload", "certificates"] as const) {
-            if (device[field] !== undefined) found.push(field);
+        const refusedGroups = [
+            ["firewall", device.firewall],
+            ["services.dhcp_server", device.services?.dhcp_server],
+            ["switching.acls", device.switching?.acls],
+            ["routing.policies", routing?.policies],
+            ["routing.prefix_sets", routing?.prefix_sets],
+            ["system.hardware_offload", device.system?.hardware_offload],
+            ["system.certificates", device.system?.certificates],
+        ] as const;
+
+        for (const [path, value] of refusedGroups) {
+            if (value !== undefined) found.push(path);
         }
 
-        for (const [name, relay] of Object.entries(device.dhcp_relay ?? {})) {
-            if (device.interfaces?.[relay.interface]?.type !== "vlan")
-                found.push(`dhcp_relay.${name}.interface, relays run on VLAN interfaces`);
+        for (const [name, relay] of Object.entries(device.services?.dhcp_relay ?? {})) {
+            if (!device.interfaces?.vlan_interface?.[relay.interface])
+                found.push(`services.dhcp_relay.${name}.interface, relays run on VLAN interfaces`);
         }
 
         // The platform reserves this name.
-        if (device.users && "admin" in device.users) found.push("users.admin, the platform reserves the name");
+        if (device.system?.users?.admin) found.push("system.users.admin, the platform reserves the name");
 
         const management = device.management ?? {};
 
-        for (const field of ["http", "https", "api", "api_tls", "ftp", "native", "privilege_password"] as const) {
+        for (const field of ["http", "https", "api", "api_tls", "ftp", "native_protocol", "privilege_password"] as const) {
             if (management[field]) found.push(`management.${field}`);
         }
 
         if (management.ssh?.auth_timeout || management.ssh?.auth_retries) found.push("management.ssh.auth_timeout and auth_retries");
 
-        if (device.lldp && device.lldp !== true) found.push("lldp.interfaces, use lldp on the ports instead");
+        const lldp = device.switching?.lldp;
+        if (lldp && lldp !== true) found.push("switching.lldp.interfaces, use lldp on the ports instead");
 
         const system = device.system ?? {};
 
         if (system.dns || system.release_channel || system.banner) found.push("system.dns, release_channel and banner");
+        if (device.services?.dns_server) found.push("services.dns_server");
 
         const local = system.logging?.local;
         if (local?.lines_per_file !== undefined)
@@ -200,27 +220,31 @@ export class Vrp extends Platform {
         if (local?.files !== undefined && !(Number.isInteger(local.files) && local.files >= 3 && local.files <= 500))
             found.push("system.logging.local.files, between 3 and 500 on the platform");
 
-        for (const collector of system.logging?.remote ?? []) {
-            if (Address.family(collector.address) === "ipv6") found.push(`system.logging.remote ${collector.address}, IPv6 is not proved`);
+        const monitoring = device.monitoring ?? {};
+
+        for (const collector of monitoring.syslog ?? []) {
+            if (Address.family(collector.address) === "ipv6") found.push(`monitoring.syslog ${collector.address}, IPv6 is not proved`);
         }
 
-        for (const source of management.snmp?.allow ?? []) {
-            if (Address.family(Address.split(source).addr) === "ipv6") found.push(`management.snmp.allow ${source}, IPv6 is not proved`);
+        for (const source of monitoring.snmp?.allow ?? []) {
+            if (Address.family(Address.split(source).addr) === "ipv6") found.push(`monitoring.snmp.allow ${source}, IPv6 is not proved`);
         }
 
-        if (system.transceiver_monitoring !== undefined) found.push("system.transceiver_monitoring");
+        if (monitoring.transceivers !== undefined) found.push("monitoring.transceivers");
 
         // SNMP takes sources of its own here, in an ACL of its own.
-        found.push(...Derive.switchUnsupported(device).filter((field) => !field.startsWith("management.snmp.allow")));
+        found.push(...Derive.switchUnsupported(device, ["snmp"]));
         found.push(...Derive.unproved(device, ["alarm-severity", "bfd-timers", "static-route-bfd", "mac-limit", "ethertype-filter"]));
 
-        const flow = device.flow_export;
-        if (flow && flow.protocol !== "sflow") found.push(`flow_export.protocol ${flow.protocol}, the platform exports sFlow`);
+        const flow = monitoring.flow_export;
+        if (flow && flow.protocol !== "sflow") found.push(`monitoring.flow_export.protocol ${flow.protocol}, the platform exports sFlow`);
         const sampling = flow?.protocol === "sflow" ? flow.sampling : undefined;
         const samplingInRange = sampling !== undefined && Number.isInteger(sampling) && sampling >= 4096 && sampling <= 4_294_967_295;
 
         if (flow?.protocol === "sflow" && !samplingInRange) {
-            found.push("flow_export.sampling, required and between 4096 and 4294967295: the platform samples, one packet in 4096 at most");
+            found.push(
+                "monitoring.flow_export.sampling, required and between 4096 and 4294967295: the platform samples, one packet in 4096 at most"
+            );
         }
 
         return found;
@@ -565,7 +589,7 @@ export class Vrp extends Platform {
         const opened = await SerialConsole.open(console);
 
         const login = async () => {
-            await SerialConsole.login(opened.channel, Vrp.CONSOLE, user, password, console.passwordOnly);
+            await SerialConsole.login(opened.channel, Vrp.CONSOLE, user, password, console.password_only);
             await Ssh.send(opened.channel, "screen-length 0 temporary", 10_000, 1500);
         };
 

package/src/platforms/vrp/render.ts

@@ -3,14 +3,10 @@
 import { Address } from "../../core/address";
 import { Secrets } from "../../core/secrets";
 import { Utils } from "../../core/utils";
-import type { Device, Interface, Port, Vrrp } from "../../schema";
+import type { Device, Lag, Port, VlanInterface, Vrrp } from "../../model";
 import { Catalog } from "../catalog";
 import { Derive } from "../derive";
 
-type AnyPort = Port<string, string, string, string>;
-type AnyInterface = Interface<string, string>;
-type LagInterface = Extract<AnyInterface, { type: "lag" }>;
-
 /** Builds the configuration as blocks: a header line, its indented lines, then `#`. */
 export class VrpRender {
     /** The ACL that guards every management service. */
@@ -66,19 +62,21 @@ export class VrpRender {
     private static readonly ETHERTYPE = { ipv4: "ip", ipv6: "ipv6", arp: "arp" } as const;
 
     private readonly lines: string[] = [];
-    private readonly vlans: NonNullable<Device["vlans"]>;
-    private readonly interfaces: NonNullable<Device["interfaces"]>;
+    private readonly vlans: NonNullable<NonNullable<Device["switching"]>["vlans"]>;
+    private readonly lags: NonNullable<NonNullable<Device["interfaces"]>["lag"]>;
+    private readonly vlanInterfaces: NonNullable<NonNullable<Device["interfaces"]>["vlan_interface"]>;
     private readonly lagNumbers: Map<string, number>;
     /** The layer 2 ACL of each set of ethertypes the ports take, by the set written as `ipv4 ipv6 arp`. */
     private readonly ethertypeAcls = new Map<string, number>();
 
     private constructor(private readonly device: Device) {
-        this.vlans = device.vlans ?? {};
-        this.interfaces = device.interfaces ?? {};
+        this.vlans = device.switching?.vlans ?? {};
+        this.lags = device.interfaces?.lag ?? {};
+        this.vlanInterfaces = device.interfaces?.vlan_interface ?? {};
         this.lagNumbers = Derive.lagIds(device);
 
-        for (const port of Object.values(device.ports ?? {})) {
-            const key = port?.ethertypes?.join(" ");
+        for (const [, port] of Derive.ports(device)) {
+            const key = port.ethertypes?.join(" ");
             if (key && !this.ethertypeAcls.has(key)) this.ethertypeAcls.set(key, VrpRender.FIRST_L2_ACL + this.ethertypeAcls.size);
         }
     }
@@ -89,6 +87,13 @@ export class VrpRender {
     }
 
     /** `99 999 to 1000 2000`, the platform's compression of a VLAN list. */
+    /** `management.allow` as a list. The project turns an address set named there into its addresses before rendering. */
+    static managementAllow(device: Device): readonly string[] {
+        const allow = device.management?.allow ?? [];
+        if (typeof allow === "string") throw new Error(`management.allow names the address set ${allow}, not its addresses`);
+        return allow;
+    }
+
     static vlanBatch(ids: number[]): string {
         const sorted = [...new Set(ids)].sort((a, b) => a - b);
         const ranges: string[] = [];
@@ -114,23 +119,23 @@ export class VrpRender {
         this.users();
         this.vrfs();
 
-        for (const [name, lag] of Object.entries(this.interfaces)) {
-            if (lag.type === "lag") this.block(`interface ${this.nameOf(name)}`, [...VrpRender.lagMode(lag), ...this.switching(lag)]);
+        for (const [name, lag] of Object.entries(this.lags)) {
+            if (lag) this.block(`interface ${this.nameOf(name)}`, [...VrpRender.lagMode(lag), ...this.switching(lag)]);
         }
 
-        for (const [name, iface] of Object.entries(this.interfaces)) {
-            if (iface.type === "vlan") this.block(`interface ${this.nameOf(name)}`, this.vlanInterface(name, iface));
+        for (const [name, iface] of Object.entries(this.vlanInterfaces)) {
+            if (iface) this.block(`interface ${this.nameOf(name)}`, this.vlanInterface(name, iface));
         }
 
         for (const port of Catalog.ports(device.platform, device.model)) {
-            const settings = device.ports?.[port as keyof typeof device.ports];
-            this.block(`interface ${this.nameOf(port)}`, this.physicalPort(port, settings));
+            this.block(`interface ${this.nameOf(port)}`, this.physicalPort(port, device.interfaces?.ethernet?.[port]));
         }
 
         this.staticRoutes();
         this.ospf();
         if (this.wantsBfd()) this.block("bfd", []);
-        if (device.dhcp_relay && Object.keys(device.dhcp_relay).length) {
+        const relays = device.services?.dhcp_relay;
+        if (relays && Object.keys(relays).length) {
             this.line("dhcp enable");
             this.separator();
         }
@@ -167,10 +172,10 @@ export class VrpRender {
 
     /** What the platform calls a port, a LAG or a VLAN interface. */
     private nameOf(portOrInterface: string): string {
-        const iface = this.interfaces[portOrInterface];
-        if (iface?.type === "lag") return `Eth-Trunk${this.lagNumbers.get(portOrInterface)}`;
+        if (this.lags[portOrInterface]) return `Eth-Trunk${this.lagNumbers.get(portOrInterface)}`;
 
-        if (iface?.type === "vlan") return `Vlanif${this.vlanId(iface.vlan)}`;
+        const vlanInterface = this.vlanInterfaces[portOrInterface];
+        if (vlanInterface) return `Vlanif${this.vlanId(vlanInterface.vlan)}`;
 
         return Catalog.spell(this.device.platform, this.device.model, portOrInterface);
     }
@@ -192,7 +197,7 @@ export class VrpRender {
             this.separator();
         }
 
-        const stp = device.stp;
+        const stp = device.switching?.stp;
         if (!stp) this.line("stp disable");
         else {
             // MSTP is the platform's default and is not written.
@@ -200,19 +205,19 @@ export class VrpRender {
             if (stp.priority !== undefined) this.line(`stp priority ${stp.priority}`);
         }
         // LLDP is off by default and turned on by the config.
-        if (device.lldp) this.line("lldp enable");
+        if (device.switching?.lldp) this.line("lldp enable");
         this.separator();
 
-        const ntp = device.system?.ntp;
-        if (!ntp?.serve) {
+        if (!device.services?.ntp_server) {
             this.line("ntp server disable");
             this.line("ntp ipv6 server disable");
         }
 
-        for (const server of ntp?.servers ?? []) this.line(`ntp unicast-server ${server}`);
+        // A server written with its length is written as the address alone.
+        for (const server of device.system?.ntp?.servers ?? []) this.line(`ntp unicast-server ${Address.host(server)}`);
         this.separator();
 
-        const ids = Object.values(device.vlans ?? {}).map((vlan) => vlan.id);
+        const ids = Object.values(this.vlans).flatMap((vlan) => (vlan ? [vlan.id] : []));
         if (ids.length) {
             this.line(`vlan batch ${VrpRender.vlanBatch(ids)}`);
             this.separator();
@@ -226,14 +231,15 @@ export class VrpRender {
     }
 
     private vlanBlocks(): void {
-        for (const [name, vlan] of Object.entries(this.device.vlans ?? {})) {
+        for (const [name, vlan] of Object.entries(this.vlans)) {
+            if (!vlan) continue;
             this.block(`vlan ${vlan.id}`, [`name ${name}`, ...(vlan.description ? [`description ${vlan.description}`] : [])]);
         }
     }
 
     /** One ACL guards every management service: a permit per source, then an explicit deny. */
     private managementAcl(): void {
-        const allow = this.device.management?.allow ?? [];
+        const allow = VrpRender.managementAllow(this.device);
         if (!allow.length) return;
 
         this.block(`acl number ${VrpRender.MANAGEMENT_ACL}`, ["description Management access", ...VrpRender.aclRules(allow)]);
@@ -249,7 +255,7 @@ export class VrpRender {
     }
 
     private snmpAcl(): void {
-        const allow = this.device.management?.snmp?.allow ?? [];
+        const allow = this.device.monitoring?.snmp?.allow ?? [];
         if (!allow.length) return;
 
         this.block(`acl number ${VrpRender.SNMP_ACL}`, ["description SNMP access", ...VrpRender.aclRules(allow)]);
@@ -269,7 +275,8 @@ export class VrpRender {
     private users(): void {
         const lines: string[] = [];
 
-        for (const [name, user] of Object.entries(this.device.users ?? {})) {
+        for (const [name, user] of Object.entries(this.device.system?.users ?? {})) {
+            if (!user) continue;
             lines.push(`local-user ${name} password irreversible-cipher ${Secrets.marker(user.password)}`);
             lines.push(`local-user ${name} service-type ssh`);
             lines.push(`local-user ${name} level ${VrpRender.USER_LEVEL[user.role]}`);
@@ -279,17 +286,19 @@ export class VrpRender {
     }
 
     private vrfs(): void {
-        for (const name of Object.keys(this.device.vrfs ?? {})) this.block(`ip vpn-instance ${name}`, ["ipv4-family"]);
+        for (const [name, vrf] of Object.entries(this.device.routing?.vrfs ?? {})) {
+            if (vrf) this.block(`ip vpn-instance ${name}`, ["ipv4-family"]);
+        }
     }
 
-    private static lagMode(lag: LagInterface): string[] {
+    private static lagMode(lag: Lag): string[] {
         const lines = [lag.mode === "static" ? "mode manual load-balance" : "mode lacp-static"];
         if (lag.description) lines.unshift(`description ${lag.description}`);
         return lines;
     }
 
     /** Layer 2 membership of a port or LAG. */
-    private switching(settings: AnyPort | LagInterface): string[] {
+    private switching(settings: Port | Lag): string[] {
         const lines: string[] = [];
         if (settings.access_vlan) lines.push(`port default vlan ${this.vlanId(settings.access_vlan)}`);
         if (settings.trunk_vlans) {
@@ -340,7 +349,7 @@ export class VrpRender {
         return lines;
     }
 
-    private vlanInterface(name: string, iface: Extract<AnyInterface, { type: "vlan" }>): string[] {
+    private vlanInterface(name: string, iface: VlanInterface): string[] {
         const device = this.device;
         const lines: string[] = [];
         if (iface.description) lines.push(`description ${iface.description}`);
@@ -356,14 +365,14 @@ export class VrpRender {
 
         for (const group of iface.vrrp ?? []) lines.push(...VrpRender.vrrpLines(group));
 
-        const relays = Object.values(device.dhcp_relay ?? {}).filter((relay) => relay.interface === name);
+        const relays = Object.values(device.services?.dhcp_relay ?? {}).filter((relay) => relay.interface === name);
         if (relays.length) {
             lines.push("dhcp select relay");
             for (const server of relays.flatMap((relay) => relay.servers)) lines.push(`dhcp relay binding server ip ${server}`);
         }
 
         for (const area of Object.values(device.routing?.ospf?.areas ?? {})) {
-            const settings = area.interfaces[name as keyof typeof area.interfaces];
+            const settings = area.interfaces[name];
             if (!settings) continue;
 
             if (settings.cost !== undefined) lines.push(`ospf cost ${settings.cost}`);
@@ -375,12 +384,12 @@ export class VrpRender {
     }
 
     /** A port the config does not declare is shut down. A LAG member holds only its membership. */
-    private physicalPort(port: string, settings: AnyPort | undefined): string[] {
+    private physicalPort(port: string, settings: Port | undefined): string[] {
         if (!settings) return ["shutdown"];
 
         // A port joins a LAG only while it holds no other setting, so membership comes before its description.
-        if (settings.lag) {
-            const membership = `eth-trunk ${this.lagNumbers.get(settings.lag)}`;
+        if (settings.in_lag) {
+            const membership = `eth-trunk ${this.lagNumbers.get(settings.in_lag)}`;
             return settings.description ? [membership, `description ${settings.description}`] : [membership];
         }
 
@@ -391,7 +400,7 @@ export class VrpRender {
         if (settings.mac_limit !== undefined) lines.push(`mac-address limit maximum ${settings.mac_limit}`);
         if (settings.ethertypes) lines.push(`traffic-filter acl ${this.ethertypeAcls.get(settings.ethertypes.join(" "))} inbound`);
 
-        const flow = this.device.flow_export;
+        const flow = this.device.monitoring?.flow_export;
         const observed = flow?.protocol === "sflow" && (!flow.interfaces || flow.interfaces.includes(port));
         if (observed) {
             for (let index = 0; index < flow!.collectors.length; index++)
@@ -407,8 +416,9 @@ export class VrpRender {
      * Static routes. A route watched by BFD needs a BFD template for its next hop first, from the device's own address on that network, with the device's timers.
      */
     private staticRoutes(): void {
-        const routes = this.device.routing?.static ?? [];
-        const watched = [...new Set(routes.filter((route) => route.bfd && route.via).map((route) => route.via!))];
+        const routes = this.device.routing?.static_routes ?? [];
+        // A next hop written with its length is written as the address alone.
+        const watched = [...new Set(routes.filter((route) => route.bfd && route.next_hop).map((route) => Address.host(route.next_hop!)))];
 
         for (const nextHop of watched) {
             const local = VrpRender.localAddressTo(this.device, nextHop);
@@ -418,7 +428,7 @@ export class VrpRender {
 
         for (const route of routes) {
             const { addr, len } = Address.split(route.prefix);
-            const nextHop = route.blackhole ? "NULL0" : (route.via ?? this.nameOf(route.interface!));
+            const nextHop = route.blackhole ? "NULL0" : route.next_hop ? Address.host(route.next_hop) : this.nameOf(route.interface!);
             const vrf = route.vrf ? ` vpn-instance ${route.vrf}` : "";
             const preference = route.distance ? ` preference ${route.distance}` : "";
             const description = route.description ? ` description ${route.description}` : "";
@@ -433,8 +443,8 @@ export class VrpRender {
 
     /** The device's own IPv4 address on the network that holds `nextHop`. `unsupported()` refuses a watched route without one. */
     static localAddressTo(device: Device, nextHop: string): string | undefined {
-        for (const iface of Object.values(device.interfaces ?? {})) {
-            for (const entry of iface.addresses ?? []) {
+        for (const { settings } of Derive.interfaces(device)) {
+            for (const entry of settings.addresses ?? []) {
                 const address = typeof entry === "string" ? entry : entry.address;
                 if (Address.contains(Address.prefixOf(address), nextHop)) return Address.host(address);
             }
@@ -482,7 +492,7 @@ export class VrpRender {
     private wantsBfd(): boolean {
         const areas = Object.values(this.device.routing?.ospf?.areas ?? {});
         const onOspf = areas.some((area) => Object.values(area.interfaces).some((settings) => settings?.bfd));
-        const onStatic = (this.device.routing?.static ?? []).some((route) => route.bfd);
+        const onStatic = (this.device.routing?.static_routes ?? []).some((route) => route.bfd);
 
         return onOspf || onStatic;
     }
@@ -490,7 +500,7 @@ export class VrpRender {
     /** sFlow from the management address, to each collector in order. */
     private flowExport(): void {
         const device = this.device;
-        const flow = device.flow_export;
+        const flow = device.monitoring?.flow_export;
         if (flow?.protocol !== "sflow") return;
 
         if (device.connection.host) this.line(`sflow agent ip ${device.connection.host}`);
@@ -505,10 +515,10 @@ export class VrpRender {
 
     /** The log files' level and count, then each syslog collector. A default the device does not print is not written: level `debugging`, 200 files, port 514. */
     private logging(): void {
-        const logging = this.device.system?.logging;
-        if (!logging) return;
+        const local = this.device.system?.logging?.local;
+        const collectors = this.device.monitoring?.syslog;
+        if (!this.device.system?.logging && !collectors) return;
 
-        const local = logging.local;
         if (local && local.level !== "debug") {
             this.line(`info-center source default channel ${VrpRender.LOGFILE_CHANNEL} log level ${VrpRender.LOG_LEVEL[local.level]}`);
         }
@@ -516,7 +526,7 @@ export class VrpRender {
         if (local?.files !== undefined && local.files !== VrpRender.LOGFILES_DEFAULT)
             this.line(`info-center max-logfile-number ${local.files}`);
 
-        for (const collector of logging.remote ?? []) {
+        for (const collector of collectors ?? []) {
             const level = collector.level === "debug" ? "" : ` level ${VrpRender.LOG_LEVEL[collector.level]}`;
             const port = collector.port !== undefined && collector.port !== VrpRender.SYSLOG_PORT ? ` port ${collector.port}` : "";
             this.line(`info-center loghost ${collector.address}${level}${port}`);
@@ -539,12 +549,12 @@ export class VrpRender {
     /** SNMP version 2c with one read community, version 3 with users in one read-only group, or both. */
     private snmp(): void {
         const device = this.device;
-        const snmp = device.management?.snmp;
+        const snmp = device.monitoring?.snmp;
         if (!snmp) return;
 
         const versions = [snmp.community ? "v2c" : "", snmp.users ? "v3" : ""].filter(Boolean).join(" ");
         const own = (snmp.allow?.length ?? 0) > 0;
-        const guarded = (device.management?.allow?.length ?? 0) > 0;
+        const guarded = VrpRender.managementAllow(device).length > 0;
         const acl = own ? ` acl ${VrpRender.SNMP_ACL}` : guarded ? ` acl ${VrpRender.MANAGEMENT_ACL}` : "";
 
         this.line("snmp-agent");
@@ -577,11 +587,12 @@ export class VrpRender {
         const ssh = device.management?.ssh;
         if (!ssh) return;
 
-        const guarded = (device.management?.allow?.length ?? 0) > 0;
+        const guarded = VrpRender.managementAllow(device).length > 0;
 
         this.line("stelnet server enable");
 
-        for (const user of Object.keys(device.users ?? {})) {
+        for (const [user, settings] of Object.entries(device.system?.users ?? {})) {
+            if (!settings) continue;
             this.line(`ssh user ${user}`);
             this.line(`ssh user ${user} authentication-type password`);
             this.line(`ssh user ${user} service-type stelnet`);