@takodotid/circuit 0.30.0 → 0.31.0

package/dist/presets/index.js

@@ -122,6 +122,7 @@ var vlansOf = (port) => [port.access_vlan, ...port.trunk_vlans ?? []].filter((vl
 var trustBoundary = (boundary) => (devices) => {
   const untrusted = new Set(boundary.untrusted);
   const routers = new Set(boundary.routers);
+  const extended = (a, b) => (boundary.extended ?? []).some(([x, y]) => x === a && y === b || x === b && y === a);
   const findings = [];
   for (const device of devices) {
     const isRouter = routers.has(device.name);
@@ -143,7 +144,8 @@ var trustBoundary = (boundary) => (devices) => {
     for (const { what, carried, faces } of carriers) {
       const mixes = carried.some((vlan) => untrusted.has(vlan)) && carried.some((vlan) => !untrusted.has(vlan));
       const facesRouter = isRouter || faces.some((name) => routers.has(name));
-      if (mixes && !facesRouter) {
+      const isExtension = faces.length > 0 && faces.every((name) => extended(device.name, name));
+      if (mixes && !facesRouter && !isExtension) {
         findings.push({
           level: "error",
           device: device.name,

package/dist/types/presets/index.d.ts

@@ -83,6 +83,10 @@ export type TrustBoundary = {
     untrusted: readonly string[];
     /** The devices that filter: the only ones that may give an untrusted VLAN an address, and the only ones a port carrying both kinds may face. */
     routers: readonly string[];
+    /**
+     * Links between two switches that may carry both kinds, each named by its two devices: a site's switch extended to another building, with an exchange's VLAN and its own management on one cable. Neither end gives an untrusted VLAN an address.
+     */
+    extended?: readonly (readonly [string, string])[];
 };
 /** A check: traffic from outside reaches your own VLANs only through a router. A port or LAG carrying an untrusted VLAN beside any other is on a router or faces one, and only a router gives an untrusted VLAN an address. */
 export declare const trustBoundary: (boundary: TrustBoundary) => Check;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.30.0",
+    "version": "0.31.0",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",

package/src/presets/index.ts

@@ -186,6 +186,10 @@ export type TrustBoundary = {
     untrusted: readonly string[];
     /** The devices that filter: the only ones that may give an untrusted VLAN an address, and the only ones a port carrying both kinds may face. */
     routers: readonly string[];
+    /**
+     * Links between two switches that may carry both kinds, each named by its two devices: a site's switch extended to another building, with an exchange's VLAN and its own management on one cable. Neither end gives an untrusted VLAN an address.
+     */
+    extended?: readonly (readonly [string, string])[];
 };
 
 /** A check: traffic from outside reaches your own VLANs only through a router. A port or LAG carrying an untrusted VLAN beside any other is on a router or faces one, and only a router gives an untrusted VLAN an address. */
@@ -194,6 +198,7 @@ export const trustBoundary =
     (devices) => {
         const untrusted = new Set(boundary.untrusted);
         const routers = new Set(boundary.routers);
+        const extended = (a: string, b: string) => (boundary.extended ?? []).some(([x, y]) => (x === a && y === b) || (x === b && y === a));
         const findings: Finding[] = [];
 
         for (const device of devices) {
@@ -225,8 +230,9 @@ export const trustBoundary =
             for (const { what, carried, faces } of carriers) {
                 const mixes = carried.some((vlan) => untrusted.has(vlan)) && carried.some((vlan) => !untrusted.has(vlan));
                 const facesRouter = isRouter || faces.some((name) => routers.has(name));
+                const isExtension = faces.length > 0 && faces.every((name) => extended(device.name, name));
 
-                if (mixes && !facesRouter) {
+                if (mixes && !facesRouter && !isExtension) {
                     findings.push({
                         level: "error",
                         device: device.name,