@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/src/integrations/peeringdb.ts

@@ -1,173 +0,0 @@
-// Keeps a network's exchange presence at PeeringDB in step with the config. Each interface with an `exchange` naming a `peeringdb_ixlan` is one record.
-//
-// Only globally reachable addresses are published: an exchange reached over a tunnel often lands on private or shared space, and publishing it would point others at a dead end. A record the config does not hold is reported, never deleted, and `operational` is never changed, since leaving an exchange is a decision made outside the config.
-
-import { Address } from "../core/address";
-import type { Network } from "../core/define";
-import { Secrets } from "../core/secrets";
-import type { Device, Interface } from "../schema";
-
-/** A network's presence at one exchange LAN, as PeeringDB holds it. */
-type NetIxLan = {
-    id: number;
-    net_id: number;
-    ixlan_id: number;
-    name: string;
-    speed: number;
-    ipaddr4: string | null;
-    ipaddr6: string | null;
-    is_rs_peer: boolean;
-    operational: boolean;
-};
-
-/** One record as the config describes it. */
-type Wanted = {
-    name: string;
-    ixlan_id: number;
-    speed: number;
-    ipaddr4: string | null;
-    ipaddr6: string | null;
-    is_rs_peer: boolean;
-};
-
-/** A change to send. `id` is set when the record exists and is updated in place. */
-export type PeeringDbChange = {
-    summary: string;
-    id?: number;
-    body: Record<string, unknown>;
-};
-
-export type PeeringDbPlan = {
-    changes: PeeringDbChange[];
-    /** Records PeeringDB holds that the config does not. */
-    unknown: string[];
-};
-
-type AnyInterface = Interface<string, string>;
-
-export class PeeringDb {
-    private static readonly API = "https://www.peeringdb.com/api";
-
-    /** What would change at PeeringDB. Reads the public API; needs no key. */
-    static async plan(network: Network): Promise<PeeringDbPlan> {
-        if (!network.asn) throw new Error("the network declares no asn");
-
-        const response = await fetch(`${PeeringDb.API}/netixlan?asn=${network.asn}`, {
-            headers: { Accept: "application/json" },
-            signal: AbortSignal.timeout(30_000),
-        });
-        if (!response.ok) throw new Error(`PeeringDB answered ${response.status}`);
-
-        const existing = ((await response.json()) as { data: NetIxLan[] }).data;
-        const desired = PeeringDb.wanted(network);
-
-        // The record that owns every presence. Taken from an existing one, since the API has no other lookup by ASN here.
-        const netId = existing[0]?.net_id;
-        const changes: PeeringDbChange[] = [];
-
-        for (const record of desired) {
-            const current = existing.find((candidate) => candidate.ixlan_id === record.ixlan_id);
-
-            const body = {
-                net_id: netId,
-                ixlan_id: record.ixlan_id,
-                asn: network.asn,
-                speed: record.speed,
-                ipaddr4: record.ipaddr4,
-                ipaddr6: record.ipaddr6,
-                is_rs_peer: record.is_rs_peer,
-                operational: current?.operational ?? true,
-            };
-
-            if (!current) {
-                changes.push({ summary: `+ ${record.name}: ${record.ipaddr4}, ${record.ipaddr6}, ${record.speed} Mbit/s`, body });
-                continue;
-            }
-
-            const differs =
-                current.ipaddr4 !== record.ipaddr4 ||
-                current.ipaddr6 !== record.ipaddr6 ||
-                current.speed !== record.speed ||
-                current.is_rs_peer !== record.is_rs_peer;
-
-            if (differs) {
-                const before = `${current.ipaddr4}, ${current.ipaddr6}, ${current.speed} Mbit/s, route server ${current.is_rs_peer}`;
-                const after = `${record.ipaddr4}, ${record.ipaddr6}, ${record.speed} Mbit/s, route server ${record.is_rs_peer}`;
-                changes.push({ summary: `~ ${record.name}: ${before} to ${after}`, id: current.id, body });
-            }
-        }
-
-        const unknown = existing
-            .filter((record) => !desired.some((candidate) => candidate.ixlan_id === record.ixlan_id))
-            .map((record) => record.name);
-
-        if (changes.some((change) => !change.id) && !netId) {
-            throw new Error("PeeringDB holds no presence for this network yet, so its record id is unknown; add the first one by hand");
-        }
-
-        return { changes, unknown };
-    }
-
-    /** Send the changes, with the network's API key. */
-    static async send(network: Network, changes: PeeringDbChange[]): Promise<void> {
-        if (!network.peeringdb) throw new Error("the network declares no peeringdb api_key");
-        const apiKey = Secrets.reveal(network.peeringdb.api_key);
-
-        for (const change of changes) {
-            const response = await fetch(`${PeeringDb.API}/netixlan${change.id ? `/${change.id}` : ""}`, {
-                method: change.id ? "PUT" : "POST",
-                headers: { Authorization: `Api-Key ${apiKey}`, "Content-Type": "application/json" },
-                body: JSON.stringify(change.body),
-                signal: AbortSignal.timeout(30_000),
-            });
-
-            if (!response.ok) {
-                const reason = (await response.text()).slice(0, 300);
-                throw new Error(`${change.summary}: PeeringDB answered ${response.status} ${reason}`);
-            }
-
-            console.log(`  sent ${change.summary}`);
-        }
-    }
-
-    private static addressesOf(iface: AnyInterface): string[] {
-        return (iface.addresses ?? []).map((entry) => (typeof entry === "string" ? entry : entry.address));
-    }
-
-    /** Whether the device peers with a route server on this interface's subnets. */
-    private static peersWithRouteServer(device: Device, iface: AnyInterface): boolean {
-        const bgp = device.routing?.bgp;
-        const subnets = PeeringDb.addressesOf(iface);
-
-        return Object.values(bgp?.neighbors ?? {}).some((neighbor) => {
-            const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
-            const role = neighbor.role ?? group?.role;
-            return role === "rs" && subnets.some((subnet) => Address.contains(subnet, neighbor.address));
-        });
-    }
-
-    /** Every exchange presence the config declares with a PeeringDB exchange LAN. */
-    private static wanted(network: Network): Wanted[] {
-        const records: Wanted[] = [];
-
-        for (const device of network.devices) {
-            for (const iface of Object.values(device.interfaces ?? {})) {
-                const exchange = iface.exchange;
-                if (!exchange?.peeringdb_ixlan) continue;
-
-                const published = PeeringDb.addressesOf(iface).map(Address.host).filter(Address.isGlobal);
-
-                records.push({
-                    name: exchange.name,
-                    ixlan_id: exchange.peeringdb_ixlan,
-                    speed: exchange.speed,
-                    ipaddr4: published.find((address) => Address.family(address) === "ipv4") ?? null,
-                    ipaddr6: published.find((address) => Address.family(address) === "ipv6") ?? null,
-                    is_rs_peer: PeeringDb.peersWithRouteServer(device, iface),
-                });
-            }
-        }
-
-        return records;
-    }
-}

package/src/integrations/prometheus.ts

@@ -1,90 +0,0 @@
-// Prometheus targets for snmp_exporter, in its file-based discovery format, and the `auths` section of its config: one auth per device, named after it, so each device is asked with its own credentials.
-//
-// The auths hold no secret. A password is written as `${NAME}`, the name of its secret, and snmp_exporter reads it from its environment when started with `--config.expand-environment-variables`.
-
-import { Document } from "yaml";
-import type { Network } from "../core/define";
-import type { Device, Secret } from "../schema";
-
-export type PrometheusTarget = { targets: string[]; labels: Record<string, string> };
-
-/** One auth in snmp_exporter's config. */
-type SnmpExporterAuth =
-    | {
-          version: 3;
-          username: string;
-          security_level: "authPriv";
-          password: string;
-          auth_protocol: string;
-          priv_protocol: string;
-          priv_password: string;
-      }
-    | { version: 2; community: string };
-
-export class Prometheus {
-    /** snmp_exporter's names for the algorithms. */
-    private static readonly AUTH = { sha1: "SHA", sha256: "SHA256" } as const;
-    private static readonly PRIVACY = { aes128: "AES", des: "DES" } as const;
-
-    private static readonly AUTHS_HEADER =
-        " Written by `circuit prometheus --auths`. Load it beside snmp.yml, with --config.expand-environment-variables.";
-
-    /** The targets, and the devices left out because their config turns SNMP off. */
-    static targets(network: Network): { targets: PrometheusTarget[]; withoutSnmp: Device[] } {
-        return {
-            targets: network.devices
-                .filter((device) => device.management?.snmp && device.connection.host)
-                .map((device) => ({
-                    targets: [device.connection.host!],
-                    // `__param_auth` picks the device's own auth in snmp_exporter.
-                    labels: { device: device.name, platform: device.platform, model: device.model, __param_auth: device.name },
-                })),
-            withoutSnmp: network.devices.filter((device) => !device.management?.snmp),
-        };
-    }
-
-    /** The `auths` section, as YAML, and what the operator must still fill in by hand. */
-    static snmpExporterAuths(network: Network): { yaml: string; notes: string[] } {
-        const notes: string[] = [];
-        const auths: Record<string, SnmpExporterAuth> = {};
-
-        for (const device of network.devices) {
-            const snmp = device.management?.snmp;
-            if (!snmp) continue;
-
-            const [name, user] = Object.entries(snmp.users ?? {})[0] ?? [];
-
-            if (name && user) {
-                auths[device.name] = {
-                    version: 3,
-                    username: name,
-                    security_level: "authPriv",
-                    password: Prometheus.fromEnvironment(user.auth_password, notes, `${device.name}'s SNMP password`),
-                    auth_protocol: Prometheus.AUTH[user.auth],
-                    priv_protocol: Prometheus.PRIVACY[user.privacy],
-                    priv_password: Prometheus.fromEnvironment(user.privacy_password, notes, `${device.name}'s SNMP privacy password`),
-                };
-            } else {
-                // snmp_exporter reads no community from the environment, and Circuit never writes a secret's value.
-                auths[device.name] = { version: 2, community: "FILL_IN" };
-                notes.push(
-                    `${device.name} has only an SNMP version 2c community, which snmp_exporter cannot read from its environment; write it in place of FILL_IN, or give the device a version 3 user`
-                );
-            }
-        }
-
-        // YAML 1.1 rules quote words such as `yes` and `on`, which older YAML readers take as true.
-        const document = new Document({ auths }, { version: "1.1" });
-        document.contents!.commentBefore = Prometheus.AUTHS_HEADER;
-
-        return { yaml: document.toString({ indent: 2 }), notes };
-    }
-
-    /** A password as snmp_exporter reads it from its environment, or a note when the secret is a file, which it cannot read. */
-    private static fromEnvironment(secret: Secret, notes: string[], where: string): string {
-        if ("secret" in secret) return `\${${secret.secret}}`;
-
-        notes.push(`${where} is read from a file; write its value in place of FILL_IN`);
-        return "FILL_IN";
-    }
-}

package/src/schema/common.ts

@@ -1,41 +0,0 @@
-/**
- * A value kept out of the repository and resolved only when a device is applied.
- *
- * `secret("NAME")` reads a variable from the environment or `.env` beside the config; a value written as `op://vault/item/field` is read from 1Password. `secretFile("path")` reads a file, relative to the config file, for a value that spans lines such as a private key in PEM. Keep that file out of git.
- */
-export type Secret =
-    | {
-          /** Name of the value in the environment or in `.env`. */
-          readonly secret: string;
-      }
-    | {
-          /** Path of the file with the value, relative to the config file. */
-          readonly secret_file: string;
-      };
-
-/** An IPv4 address, four numbers with dots between them, for example `10.0.0.1`. The type checks the shape; `circuit validate` checks each number is 0 to 255. */
-export type IPv4 = `${number}.${number}.${number}.${number}`;
-
-/** An IPv6 address, groups with colons between them, for example `2001:db8::1`. The type only checks there is a colon; `circuit validate` checks the rest. */
-export type IPv6 = `${string}:${string}`;
-
-/** An address without a length, IPv4 or IPv6, for example `10.0.0.1` or `2001:db8::1`. */
-export type IP = IPv4 | IPv6;
-
-/** A network with its length, for example `10.0.0.0/24` or `2001:db8::/32`. */
-export type Prefix = `${IP}/${number}`;
-
-/** An interface address with its length, for example `10.0.0.1/24` or `2001:db8::1/64`. */
-export type InterfaceAddress = `${IP}/${number}`;
-
-/** A MAC address, six pairs of hex digits with colons between them, for example `02:00:00:00:00:01`. */
-export type MacAddress = `${string}:${string}:${string}:${string}:${string}:${string}`;
-
-/** An address family. */
-export type Family = "ipv4" | "ipv6";
-
-/** Bits per second, for example `2G`, `500M` or `64k`. */
-export type Rate = `${number}${"k" | "M" | "G"}`;
-
-/** A log severity, most severe first. A threshold includes everything above it. */
-export type Severity = "emergency" | "alert" | "critical" | "error" | "warning" | "notice" | "info" | "debug";

package/src/schema/device.ts

@@ -1,145 +0,0 @@
-import type { IP, Secret } from "./common";
-import type { AclRule, Firewall } from "./firewall";
-import type { Interface, Port, Vlan } from "./interfaces";
-import type { PrefixSet, RoutePolicy } from "./policy";
-import type { Routing, StaticRoute } from "./routing";
-import type { Certificate, DhcpRelay, DhcpServer, FlowExport, Management, System, User } from "./system";
-
-/** How the framework reaches the device. */
-export type Connection<U extends string> = {
-    /** Management address. Absent for a device reached only through its console, `console`. */
-    host?: IP;
-    /** One of the device's `users`. Its password is the login. */
-    user: U;
-    /** SSH port. 22 when absent. */
-    port?: number;
-    /** The device's serial console, for `--console`: the way in before the device has a management address, or when its management network is down. */
-    console?: Console;
-};
-
-/** A computer with SSH that holds the serial consoles of devices, such as a laptop beside the rack. It runs Python 3. */
-export type Jump = {
-    /** Its address or name. */
-    host: string;
-    /** The user Circuit logs in as. It must be allowed to open the serial ports. */
-    user: string;
-    /** The user's password. */
-    password: Secret;
-    /** SSH port. 22 when absent. */
-    port?: number;
-    /** The jump host is reached through a Cloudflare Tunnel, so Circuit connects with `cloudflared access ssh`, which must be installed. */
-    cloudflared?: true;
-};
-
-/** A serial console, on a jump host or on the computer Circuit runs on. */
-export type Console = {
-    /** The jump host the console cable is plugged into. When absent, the cable is plugged into the computer Circuit runs on. */
-    jump?: Jump;
-    /** The serial port: on Linux or macOS a path under `/dev`, where a path under `/dev/serial/by-path/` stays the same when two adapters swap names; on Windows a COM port, such as `COM3`. */
-    port: string;
-    /** Line speed in bits per second, such as 9600 or 115200. */
-    baud: number;
-    /** The console asks only for a password, with no name first. Circuit then types no name; `connection.user` still picks the password. */
-    passwordOnly?: true;
-};
-
-/**
- * Virtual domains, on FortiOS: the device's own traffic kept apart from the traffic it routes. Everything is in `root` when absent.
- *
- * Multi-VDOM mode is turned on by hand, not by a plan: it moves the whole configuration into `root` and ends every session.
- */
-export type Vdoms<I extends string> = {
-    /**
-     * A VDOM for the device's own traffic: FortiGuard, NTP, DNS and logging leave from it, by its own routes, so they never follow the routed traffic's default route. Everything not listed here stays in `root`.
-     */
-    management: {
-        /** Its name, such as `mgmt`. Not `root`. */
-        name: string;
-        /** The ports and interfaces in it, by name. A LAG's member ports go with the LAG. */
-        interfaces: readonly I[];
-        /** Its static routes, such as its own default route. */
-        static?: readonly StaticRoute<I, never>[];
-    };
-};
-
-/** A separate routing table, with the interfaces that route in it. */
-export type Vrf = {
-    /** What the VRF is for. */
-    description?: string;
-};
-
-/**
- * Everything one device runs. What is not written here is removed from the device or returned to its default.
- *
- * Type parameters are the names the device declares, so a reference to a name that does not exist fails to compile: N ports, V VLANs, I interfaces, P policies, S prefix sets, G BGP groups, A ACLs, AS address sets, U users, F VRFs, C certificates, T routing tables.
- */
-export type Device<
-    Pl extends string = string,
-    M extends string = string,
-    N extends string = string,
-    V extends string = string,
-    I extends string = string,
-    P extends string = string,
-    S extends string = string,
-    G extends string = string,
-    A extends string = string,
-    AS extends string = string,
-    U extends string = string,
-    F extends string = string,
-    C extends string = string,
-    T extends string = string,
-> = {
-    /** Hostname. */
-    name: string;
-    /** Operating system. It decides which adapter renders and applies the device. */
-    platform: Pl;
-    /** Hardware model. Decides which port names exist. */
-    model: M;
-    /** How the framework logs in. */
-    connection: Connection<NoInfer<U>>;
-    /** Device-wide settings. */
-    system?: System;
-    /** Logins, keyed by user name. Users not listed are removed. */
-    users?: Record<U, User>;
-    /** Ways in, and who may use them. */
-    management?: Management<NoInfer<I | N>, NoInfer<C>>;
-    /** Certificates, keyed by name. */
-    certificates?: Record<C, Certificate>;
-    /** VLANs, keyed by name. */
-    vlans?: Record<V, Vlan>;
-    /** Physical ports, keyed by `<speed>-<position>`. */
-    ports?: Partial<Record<N, Port<NoInfer<V>, NoInfer<A>, NoInfer<I>, NoInfer<F>>>>;
-    /** Interfaces that are not physical ports, keyed by name. */
-    interfaces?: Record<I, Interface<NoInfer<V>, NoInfer<F>>>;
-    /** Separate routing tables, keyed by name. */
-    vrfs?: Record<F, Vrf>;
-    /** Routing tables and rules, static routes, BGP, OSPF and route validation. */
-    routing?: Routing<NoInfer<P>, G, NoInfer<I | N>, NoInfer<F>, T>;
-    /** Route policies, keyed by name. */
-    policies?: Record<P, RoutePolicy<NoInfer<P>, NoInfer<S>>>;
-    /** Prefix sets that policies match on, keyed by name. */
-    prefix_sets?: Record<S, PrefixSet>;
-    /** Packet filtering and address translation. */
-    firewall?: Firewall<NoInfer<I | N>, AS>;
-    /** Hardware ACLs, keyed by name, applied to a port with `acl`. */
-    acls?: Record<A, readonly AclRule<NoInfer<V>>[]>;
-    /** DHCP servers, keyed by name. */
-    dhcp?: Record<string, DhcpServer<NoInfer<I | N>>>;
-    /** DHCP relays, keyed by name. */
-    dhcp_relay?: Record<string, DhcpRelay<NoInfer<I | N>>>;
-    /** Flow records or packet samples sent to collectors. */
-    flow_export?: FlowExport<NoInfer<I | N>>;
-    /** Advertise and learn neighbors with LLDP on every port, or only on the interfaces listed. A port may override it. */
-    lldp?: true | { interfaces: readonly NoInfer<I | N>[] };
-    /** Spanning tree on every switched port. A port may override it. */
-    stp?: {
-        /** Which variant runs. RSTP when absent. */
-        mode?: "stp" | "rstp" | "mstp";
-        /** Bridge priority, 0 to 61440 in steps of 4096. Lower wins the root election. */
-        priority?: number;
-    };
-    /** Forward in hardware where the platform can. An interface may override it. */
-    hardware_offload?: boolean;
-    /** Virtual domains, on FortiOS only: a management VDOM apart from the routed traffic. */
-    vdoms?: Vdoms<NoInfer<I | N>>;
-};

package/src/schema/firewall.ts

@@ -1,140 +0,0 @@
-import type { Family, IP, Prefix, Rate } from "./common";
-
-/** An IP protocol. `icmp` means ICMPv6 in an IPv6 rule. */
-export type Protocol = "tcp" | "udp" | "icmp" | "gre" | "esp" | "ah" | "ospf" | "vrrp";
-
-/** The state connection tracking assigns a packet. */
-export type ConnectionState = "new" | "established" | "related" | "untracked" | "invalid";
-
-/** Ports from `min` to `max`, both included. */
-export type PortRange = { min: number; max: number };
-
-/** A port, a range of ports, or any of several. */
-export type Ports = number | PortRange | readonly (number | PortRange)[];
-
-/** A TCP header flag. */
-export type TcpFlag = "fin" | "syn" | "rst" | "psh" | "ack" | "urg";
-
-/** Conditions on a packet. All must be true. A rule with addresses of one family applies to that family only. */
-export type FilterMatch<I extends string, AS extends string> = {
-    /** Only packets of this family. */
-    family?: Family;
-    /** IP protocol. */
-    protocol?: Protocol;
-    /** Source address or prefix. */
-    src?: Prefix;
-    /** Destination address or prefix. */
-    dst?: Prefix;
-    /** Source is in this address set. */
-    src_set?: AS;
-    /** Destination is in this address set. */
-    dst_set?: AS;
-    /** Source port, or any of several. TCP and UDP only. */
-    src_port?: Ports;
-    /** Destination port, or any of several. TCP and UDP only. */
-    dst_port?: Ports;
-    /** Arrived on this interface. */
-    in_interface?: I;
-    /** Leaves through this interface. */
-    out_interface?: I;
-    /** Connection tracking state, any of these. */
-    state?: readonly ConnectionState[];
-    /** TCP flags that must be set, and flags that must not be. */
-    tcp_flags?: { set?: readonly TcpFlag[]; unset?: readonly TcpFlag[] };
-};
-
-/** One firewall rule. */
-export type FilterRule<I extends string, AS extends string> = {
-    /** Shown beside the rule on the device. */
-    description?: string;
-    /** Which packets the rule applies to. Every packet when absent. */
-    match?: FilterMatch<I, AS>;
-    /** What happens to a matching packet. `reject` answers the sender, `drop` does not. */
-    action: "accept" | "drop" | "reject";
-    /** Send the rest of an accepted flow through the fast path, skipping the remaining rules. */
-    offload?: true;
-};
-
-/** Rules evaluated in order, first match wins, then `default`. */
-export type Chain<I extends string, AS extends string> = {
-    /** What happens to a packet no rule matched. Accept when absent. */
-    default?: "accept" | "drop";
-    /** Evaluated in order. */
-    rules?: readonly FilterRule<I, AS>[];
-};
-
-/** One address translation. */
-export type NatRule<I extends string, AS extends string> = {
-    /** Shown beside the rule on the device. */
-    description?: string;
-    /** Which packets are translated. Every packet when absent. */
-    match?: FilterMatch<I, AS>;
-} & (
-    | {
-          /** Use the address of the outgoing interface. */
-          action: "masquerade";
-      }
-    | {
-          /** `snat` rewrites the source, `dnat` the destination. */
-          action: "snat" | "dnat";
-          /** The address to rewrite to. */
-          to: IP;
-          /** The port to rewrite to. Unchanged when absent. */
-          to_port?: number;
-      }
-);
-
-/** Connection-tracking helpers that rewrite application payloads. None run unless listed. */
-export type Helper = "ftp" | "tftp" | "sip" | "h323" | "pptp" | "rtsp" | "irc";
-
-/** What the device filters and translates. */
-export type Firewall<I extends string, AS extends string> = {
-    /** Named groups of addresses and prefixes, of either family, that rules match on. */
-    address_sets?: Record<AS, readonly (IP | Prefix)[]>;
-    /** Traffic to the device, through it, and from it. */
-    filter?: {
-        input?: Chain<I, NoInfer<AS>>;
-        forward?: Chain<I, NoInfer<AS>>;
-        output?: Chain<I, NoInfer<AS>>;
-    };
-    /** Source translation on the way out, destination translation on the way in. */
-    nat?: {
-        source?: readonly NatRule<I, NoInfer<AS>>[];
-        destination?: readonly NatRule<I, NoInfer<AS>>[];
-    };
-    /** Helpers that run. None when absent. */
-    helpers?: readonly Helper[];
-    /**
-     * Traffic to and from these prefixes passes without connection tracking. A flood toward them cannot fill the connection table, and rules see its packets in the state `untracked`. Everything is tracked when absent.
-     *
-     * Each address NAT uses inside one of these prefixes (a source translation's `to`, a destination translation's `to` or matched `dst`) stays tracked: Circuit writes two accept rules for it, one for traffic to it and one for traffic from it, before the untracked rules. Without them, a reply to that address would skip tracking and never be translated back.
-     */
-    untracked?: readonly Prefix[];
-};
-
-/** A stateless rule evaluated in hardware where traffic arrives, before routing. */
-export type AclRule<V extends string> = {
-    /** Shown beside the rule on the device. */
-    description?: string;
-    /** Which packets the rule applies to. Every packet when absent. */
-    match?: {
-        /** Only packets of this family. */
-        family?: Family;
-        /** IP protocol. */
-        protocol?: Protocol;
-        /** Source prefix. */
-        src?: Prefix;
-        /** Destination prefix. */
-        dst?: Prefix;
-        /** Source port, or any of several. */
-        src_port?: Ports;
-        /** Destination port, or any of several. */
-        dst_port?: Ports;
-        /** In this VLAN. */
-        vlan?: V;
-    };
-    /** What happens to a matching packet. */
-    action: "accept" | "drop";
-    /** Accepted traffic above this rate is dropped. On RouterOS it did not limit traffic the CPU routes; see its TRAPS.md. */
-    rate?: Rate;
-};

package/src/schema/index.ts

@@ -1,8 +0,0 @@
-export type * from "./common";
-export type * from "./device";
-export type * from "./firewall";
-export type * from "./interfaces";
-export type * from "./policy";
-export type * from "./routing";
-export type * from "./system";
-export type * from "./time-zones";