@takodotid/circuit 1.0.0-rc.1 → 1.0.0-rc.3

package/README.md

@@ -88,9 +88,9 @@ In the editor, `"10g-49"` is an error, `10g-49 is not a port of CE6855-48S6Q-HI`
 
 ## Start
 
-1. Install Circuit:
-    - Linux and macOS: `curl -fsSL https://circuit.tako.id/install | sh`
-    - Windows, in PowerShell: `irm https://circuit.tako.id/install.ps1 | iex`
+1. Install Circuit. Circuit v1 is a release candidate, so its installers come from its GitHub release until circuit.tako.id serves v1:
+    - Linux and macOS: `curl -fsSL https://github.com/takodotid/circuit/releases/download/v1.0.0-rc.2/install | sh`
+    - Windows, in PowerShell: `irm https://github.com/takodotid/circuit/releases/download/v1.0.0-rc.2/install.ps1 | iex`
 2. Start a project: `circuit new network`. Open its folder in VS Code. Add a site in `circuit.ts`, then write each device in `sites/<site>/<device>.ts`.
 3. Run `circuit`. It opens a menu, or runs a command straight away, such as `circuit validate`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "1.0.0-rc.1",
+    "version": "1.0.0-rc.3",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. One binary, nothing to install.",
     "homepage": "https://circuit.tako.id",
     "bugs": {

package/src/checks/device.ts

@@ -77,7 +77,7 @@ export class DeviceChecks {
         DeviceChecks.interfaces(device, ports, report, ip);
         DeviceChecks.routing(device, report, cidr, ip);
         DeviceChecks.policies(device, report, cidr);
-        DeviceChecks.firewall(device, cidr);
+        DeviceChecks.firewall(device, report, cidr);
         DeviceChecks.services(device, report, cidr);
         DeviceChecks.certificates(device, report);
         DeviceChecks.vdoms(device, report, cidr, ip);
@@ -217,17 +217,53 @@ export class DeviceChecks {
             const where = `interfaces.${kind}.${name}`;
             if (ports.includes(name)) report(`${where} has the name of a port`);
 
-            if (kind === "gre" || kind === "vxlan") {
+            if (kind === "gre" || kind === "vxlan" || kind === "eoip") {
                 const tunnel = settings as Extract<Interface, { remote_address: string }>;
                 ip(where, tunnel.local_address);
                 ip(where, tunnel.remote_address);
             }
 
+            if (kind === "eoip") {
+                const id = (settings as Extract<Interface, { tunnel_id: number }>).tunnel_id;
+                if (!(Number.isInteger(id) && id >= 0 && id <= 65535))
+                    report(`${where}.tunnel_id ${id} is not a whole number from 0 to 65535`);
+
+                const same = Object.entries(device.interfaces?.eoip ?? {}).find(
+                    ([other, tunnel]) => other !== name && tunnel?.tunnel_id === id
+                );
+                if (same && same[0] > name) report(`${where}.tunnel_id ${id} is also interfaces.eoip.${same[0]}'s`);
+            }
+
+            if (settings.shaping && !(settings.shaping.mbps > 0)) report(`${where}.shaping.mbps ${settings.shaping.mbps} is not above 0`);
+
+            if (kind === "vlan_interface") {
+                const subnets = (settings.addresses ?? []).map((entry) => DeviceChecks.addressOf(entry));
+
+                for (const address of (settings as Extract<Interface, { vlan: string }>).proxy_arp ?? []) {
+                    ip(`${where}.proxy_arp`, address);
+                    if (!subnets.some((subnet) => Address.isCidr(subnet) && Address.contains(subnet, address)))
+                        report(`${where}.proxy_arp ${address} is in none of its subnets, so no host there asks for it`);
+                }
+            }
+
             if (kind === "lag") {
+                const lag = settings as Extract<Interface, { mode?: string }> & {
+                    link_check?: { arp_targets: readonly string[]; interval_ms: number };
+                };
                 DeviceChecks.frames(where, settings as Switched, report);
 
-                const members = Derive.ports(device).filter(([, port]) => port.in_lag === name);
-                if (!members.length) report(`${where} has no member ports`);
+                const ports = Derive.ports(device).filter(([, port]) => port.in_lag === name);
+                const tunnels = Object.entries(device.interfaces?.eoip ?? {}).filter(([, tunnel]) => tunnel?.in_lag === name);
+                if (!ports.length && !tunnels.length) report(`${where} has no members`);
+                if (tunnels.length && lag.mode !== "round_robin") report(`${where} has EoIP members, which only a round_robin LAG takes`);
+
+                const check = lag.link_check;
+                if (check) {
+                    if (!check.arp_targets.length) report(`${where}.link_check.arp_targets is empty`);
+                    for (const target of check.arp_targets) ip(`${where}.link_check.arp_targets`, target);
+                    if (!(Number.isInteger(check.interval_ms) && check.interval_ms > 0))
+                        report(`${where}.link_check.interval_ms ${check.interval_ms} is not a whole number above 0`);
+                }
             }
 
             if (kind === "bridge") {
@@ -355,7 +391,7 @@ export class DeviceChecks {
         for (const policy of Object.keys(policies)) visit(policy, []);
     }
 
-    private static firewall(device: Device, cidr: Checker): void {
+    private static firewall(device: Device, report: Report, cidr: Checker): void {
         const firewall = device.firewall;
 
         for (const [name, members] of Object.entries(firewall?.address_sets ?? {})) {
@@ -371,8 +407,15 @@ export class DeviceChecks {
             })),
             { where: "firewall.nat.source", rules: firewall?.nat?.source ?? [] },
             { where: "firewall.nat.destination", rules: firewall?.nat?.destination ?? [] },
+            { where: "firewall.tcp_mss", rules: firewall?.tcp_mss ?? [] },
         ];
 
+        (firewall?.tcp_mss ?? []).forEach((rule, index) => {
+            // 536 is the MSS every IPv4 host takes (RFC 879); 65495 is the largest IP packet less 40 bytes of headers.
+            if (rule.mss !== "path_mtu" && !(Number.isInteger(rule.mss) && rule.mss >= 536 && rule.mss <= 65495))
+                report(`firewall.tcp_mss[${index}].mss ${rule.mss} is not "path_mtu" or a whole number from 536 to 65495`);
+        });
+
         for (const { where, rules } of chains) {
             for (const rule of rules) {
                 // The model holds one prefix a side; a list is taken as the language writes it.

package/src/cli/app.ts

@@ -42,11 +42,15 @@ export class App {
             App.removeFromWindowsPath(folder);
             spawnSync("reg", ["delete", App.UNINSTALL_KEY, "/f"], { stdio: "ignore" });
 
-            // Windows does not let a running program delete itself, so a separate process deletes it once this one has ended.
-            spawn("cmd", ["/c", `ping -n 3 127.0.0.1 >nul & del /f /q "${binary}" & del /f /q "${binary}.old" & rmdir "${folder}"`], {
+            // Windows does not let a running program delete itself, so a separate process deletes it once this one has ended: it tries
+            // again until the file goes, for about ten seconds. Only cmd's own commands: a program it started, such as ping to wait,
+            // would open a console window. The line goes to cmd as written; quoted the usual way, cmd can't read the paths.
+            const remove = `del /f /q "${binary}" "${binary}.old" 2>nul & if not exist "${binary}" (rmdir "${folder}" 2>nul & exit)`;
+            spawn("cmd", ["/d", "/c", `for /l %i in (1,1,10000) do @(${remove})`], {
                 detached: true,
                 stdio: "ignore",
                 windowsHide: true,
+                windowsVerbatimArguments: true,
             }).unref();
         } else {
             rmSync(binary, { force: true });