@takodotid/circuit 0.24.0 → 0.26.0

package/src/core/across.ts

@@ -169,7 +169,7 @@ function checkLinks(devices: readonly Device[]): Finding[] {
     return findings;
 }
 
-/** No address is held by two devices. Two loopbacks may hold one on purpose, for anycast, so that is a warning. */
+/** No address is held by two devices in one VRF. Two loopbacks may hold one on purpose, for anycast, so that is a warning. */
 function checkAddresses(holders: Holder[]): Finding[] {
     const findings: Finding[] = [];
     const first = new Map<string, Holder>();
@@ -177,7 +177,7 @@ function checkAddresses(holders: Holder[]): Finding[] {
     const isLoopback = (holder: Holder) => holder.device.interfaces?.[holder.name]?.type === "loopback";
 
     for (const holder of holders) {
-        const key = keyOf(host(holder.address))!;
+        const key = `${holder.vrf ?? ""} ${keyOf(host(holder.address))!}`;
         const earlier = first.get(key);
 
         if (!earlier) {
@@ -321,13 +321,16 @@ function checkTunnels(devices: readonly Device[], owners: Map<string, Holder>):
             findings.push({ level: "error", device: end.device.name, message: `interface ${end.name}: ${message}` });
         const kind = end.iface.type === "gre" ? "GRE" : "VXLAN";
 
-        const mirror = ends.find(
+        // Two routers may run several VXLAN tunnels between them, one for each VNI, so a tunnel pairs with the one of its own VNI first.
+        const back = ends.filter(
             (other) =>
                 other.device === far &&
                 other.iface.type === end.iface.type &&
                 same(other.iface.local, end.iface.remote) &&
                 same(other.iface.remote, end.iface.local)
         );
+        const vniOf = (iface: Gre<string> | Vxlan<string>) => (iface.type === "vxlan" ? iface.vni : undefined);
+        const mirror = back.find((other) => vniOf(other.iface) === vniOf(end.iface)) ?? back[0];
 
         if (!mirror) {
             report(`${end.iface.remote} is ${far.name}'s, which has no ${kind} tunnel from there back to ${end.iface.local}`);

package/src/core/graph.ts

@@ -72,6 +72,8 @@ export type Holder = {
     /** The far end of a point-to-point address. */
     peer?: string;
     vrrp: NonNullable<Routed<string>["vrrp"]>;
+    /** The VRF the address is in. The default table when absent. */
+    vrf?: string;
 };
 
 export const deviceId = (name: string) => `device:${name}`;
@@ -124,7 +126,7 @@ export function holdersOf(devices: readonly Device[]): Holder[] {
                 if (!isCidr(address)) return [];
 
                 const peer = typeof entry === "string" ? undefined : entry.peer;
-                return [{ device, name, address, peer, vrrp: settings.vrrp ?? [] }];
+                return [{ device, name, address, peer, vrrp: settings.vrrp ?? [], vrf: settings.vrf }];
             })
         )
     );

package/src/core/validate.ts

@@ -101,7 +101,7 @@ function checkVlans(device: Device, report: Report): void {
     }
 }
 
-/** Every address is valid, and no address sits on two interfaces. */
+/** Every address is valid, and no address sits on two interfaces of one routing table. Two VRFs may hold the same address. */
 function checkAddresses(device: Device, report: Report, cidr: Checker, ip: Checker): void {
     const holderOf = new Map<string, string>();
     const holders = [
@@ -116,8 +116,9 @@ function checkAddresses(device: Device, report: Report, cidr: Checker, ip: Check
             if (typeof entry !== "string") ip(where, entry.peer);
 
             const bare = address.split("/")[0]!;
-            if (holderOf.has(bare)) report(`${bare} is on both ${holderOf.get(bare)} and ${where}`);
-            holderOf.set(bare, where);
+            const key = `${settings?.vrf ?? ""} ${bare}`;
+            if (holderOf.has(key)) report(`${bare} is on both ${holderOf.get(key)} and ${where}`);
+            holderOf.set(key, where);
         }
 
         for (const group of settings?.vrrp ?? []) {

package/src/presets/index.ts

@@ -496,7 +496,7 @@ export type InternetExchange<V extends string> = {
  * Member ports and a check for an internet exchange's fabric.
  *
  * - `ports(device)`: every member's port on one switch. A member port is in the peering VLAN and nothing else, takes no part in spanning tree or LLDP, and lets only a trickle of broadcast, multicast and unknown unicast through.
- * - `check`: members never share a name, an AS or an address; every address is inside the peering LAN and not reserved; every member port carries the peering VLAN alone.
+ * - `check`: members never share a name, an AS, an address or a port; every address is inside the peering LAN and not reserved; every member port carries the peering VLAN alone.
  */
 export function internetExchange<const V extends string>(exchange: InternetExchange<V>, members: readonly ExchangeMember[]) {
     const percent = exchange.storm_percent ?? 1;
@@ -524,6 +524,8 @@ export function internetExchange<const V extends string>(exchange: InternetExcha
         const findings: Finding[] = [];
         const error = (message: string, device?: string) => findings.push({ level: "error", ...(device ? { device } : {}), message });
         const taken = new Map<string, string>((exchange.reserved ?? []).map((address) => [address, "reserved"]));
+        // `ports()` writes one port per name, so a second member on a port would silently replace the first.
+        const portHolders = new Map<string, string>();
 
         members.forEach((member, index) => {
             for (const other of members.slice(index + 1)) {
@@ -544,6 +546,10 @@ export function internetExchange<const V extends string>(exchange: InternetExcha
             }
 
             for (const [deviceName, portName] of Object.entries(member.ports)) {
+                const holder = portHolders.get(`${deviceName} ${portName}`);
+                if (holder) error(`port ${portName} is given to both ${holder} and ${member.name}`, deviceName);
+                portHolders.set(`${deviceName} ${portName}`, member.name);
+
                 const device = devices.find((candidate) => candidate.name === deviceName);
                 const port = device?.ports?.[portName as keyof typeof device.ports];
                 const carried = port ? vlansOf(port) : [];

package/templates/colocation/checks.ts

@@ -12,7 +12,7 @@ export default [
     // Traffic from the transit and the exchange reaches the tenants only through the router, which filters it.
     trustBoundary({ untrusted: ["transit", "ix"], routers: ["edge-01"] }),
 
-    // Tenants never share a name, a number or an address.
+    // Tenants never share a name, a number, an address or a port. A port given twice would go to the last tenant alone.
     () => {
         const findings: Finding[] = [];
         const error = (message: string) => findings.push({ level: "error", message });
@@ -28,6 +28,13 @@ export default [
                 }
             }
 
+            for (const [device, ports] of Object.entries(t.ports)) {
+                for (const port of Object.keys(ports)) {
+                    const sharer = TENANTS.slice(index + 1).find((other) => other.ports[device]?.[port]);
+                    if (sharer) error(`port ${port} on ${device} is given to both ${t.name} and ${sharer.name}`);
+                }
+            }
+
             for (const { prefix, gateway } of t.blocks) {
                 if (!contains(prefix, gateway)) error(`the gateway ${gateway} of ${t.name} is outside ${prefix}`);
             }