@takodotid/circuit 0.34.3 → 0.35.0

package/src/core/across.ts

@@ -1,350 +0,0 @@
-// Rules that span devices: what one device declares about another has to agree with what the other declares.
-
-import type { Device, Gre, Port, Routed, Switched, Vxlan } from "../schema";
-import { contains, familyOf, host, isCidr, network as prefixOf } from "./addr";
-import type { Finding } from "./define";
-import { type Holder, holdersOf, keyOf } from "./graph";
-
-/** Every rule across devices. */
-export function checkAcross(devices: readonly Device[]): Finding[] {
-    const holders = holdersOf(devices);
-
-    // Who holds each address. The first holder wins; a second is reported by checkAddresses.
-    const owners = new Map<string, Holder>();
-    for (const holder of holders) {
-        const key = keyOf(host(holder.address))!;
-        if (!owners.has(key)) owners.set(key, holder);
-    }
-
-    return [
-        ...checkLinks(devices),
-        ...checkAddresses(holders),
-        ...checkSessions(devices, owners),
-        ...checkVrrp(holders),
-        ...checkTunnels(devices, owners),
-    ];
-}
-
-/** The VLAN ids a port or LAG carries, by how it carries them, so two ends can be compared across devices. */
-function carried(device: Device, settings: Switched<string>) {
-    const id = (vlan: string | undefined) => (vlan ? device.vlans?.[vlan]?.id : undefined);
-    return {
-        access: id(settings.access_vlan),
-        native: id(settings.native_vlan),
-        trunk: (settings.trunk_vlans ?? []).map(id).sort((a, b) => (a ?? 0) - (b ?? 0)),
-    };
-}
-
-/** How a port carries its VLANs, in words: "VLANs 10, 20 tagged and VLAN 30 untagged as native". */
-function describeCarried({ access, native, trunk }: ReturnType<typeof carried>): string {
-    const parts: string[] = [];
-    const tagged = trunk.filter((id) => id !== undefined);
-
-    if (access !== undefined) parts.push(`VLAN ${access} untagged`);
-    if (tagged.length) parts.push(`${tagged.length === 1 ? "VLAN" : "VLANs"} ${tagged.join(", ")} tagged`);
-    if (native !== undefined) parts.push(`VLAN ${native} untagged as native`);
-
-    return parts.length ? parts.join(" and ") : "no VLANs";
-}
-
-/** VLAN names by id, for the VLANs a port or LAG carries. */
-function vlanNames(device: Device, settings: Switched<string>): Map<number, string> {
-    const names = [settings.access_vlan, settings.native_vlan, ...(settings.trunk_vlans ?? [])].filter((name) => name !== undefined);
-
-    return new Map(names.flatMap((name) => (device.vlans?.[name] ? [[device.vlans[name].id, name] as const] : [])));
-}
-
-/** What a port's settings are kept on: the LAG when the port is a member of one, otherwise the port. */
-function carrierOf(device: Device, portName: string, port: Port<string, string, string, string>) {
-    const lag = port.lag ? device.interfaces?.[port.lag] : undefined;
-    if (port.lag && lag?.type === "lag") return { name: port.lag, settings: lag };
-
-    return { name: portName, settings: port };
-}
-
-/** The plain addresses of one family on an interface, leaving out point-to-point ones. */
-const plainAddresses = (settings: Routed<string>, family: string) =>
-    (settings.addresses ?? []).filter((entry): entry is string => typeof entry === "string" && isCidr(entry) && familyOf(entry) === family);
-
-/** Why the two ends of a cable cannot reach each other by address, or undefined when they can. */
-function addressDisagreement(here: Routed<string>, there: Routed<string>, far: Device, farName: string): string | undefined {
-    for (const family of ["ipv4", "ipv6"]) {
-        const ours = plainAddresses(here, family);
-        const theirs = plainAddresses(there, family);
-        if (!ours.length || !theirs.length) continue;
-
-        // A prefix includes its length, so 10.0.0.0/24 and 10.0.0.0/25 are not one.
-        const theirPrefixes = new Set(theirs.map(prefixOf));
-        if (!ours.some((address) => theirPrefixes.has(prefixOf(address)))) {
-            return `has ${ours.join(", ")}, and ${far.name} ${farName} has ${theirs.join(", ")}: not one prefix of one length`;
-        }
-    }
-
-    // A point-to-point address names the far end's own address as its peer.
-    const farHosts = new Set((there.addresses ?? []).map((entry) => keyOf(host(typeof entry === "string" ? entry : entry.address))));
-
-    for (const entry of here.addresses ?? []) {
-        if (typeof entry === "string" || !keyOf(entry.peer) || farHosts.has(keyOf(entry.peer))) continue;
-        return `${entry.address} names peer ${entry.peer}, which ${far.name} ${farName} does not hold`;
-    }
-
-    return undefined;
-}
-
-/** A link names a device and port that exist, the far end links back, and both ends carry the same VLANs the same way, with the same MTU, speed and addresses. */
-function checkLinks(devices: readonly Device[]): Finding[] {
-    const findings: Finding[] = [];
-    const byName = new Map(devices.map((device) => [device.name, device]));
-
-    for (const device of devices) {
-        for (const [portName, port] of Object.entries(device.ports ?? {})) {
-            const link = port?.link;
-            if (!port || !link) continue;
-
-            const report = (message: string, level: Finding["level"] = "error") =>
-                findings.push({
-                    level,
-                    device: device.name,
-                    message: `port ${portName} link: ${message}`,
-                });
-
-            const far = byName.get(link.device);
-            if (!far) {
-                report(`device ${link.device} is not in the network`);
-                continue;
-            }
-
-            const farPort = far.ports?.[link.port];
-            if (!farPort) {
-                report(`${link.device} does not declare port ${link.port}`);
-                continue;
-            }
-
-            const linksBack = farPort.link?.device === device.name && farPort.link.port === portName;
-            if (!linksBack) {
-                report(`${link.device} ${link.port} does not link back to it`);
-                continue;
-            }
-
-            const near = carrierOf(device, portName, port);
-            const away = carrierOf(far, link.port, farPort);
-
-            // A LAG's VLANs are on the LAG, so its member ports are compared by what their LAGs carry.
-            const inLag = near.name !== portName;
-            const farInLag = away.name !== link.port;
-            if (inLag !== farInLag) {
-                report(
-                    inLag
-                        ? `${portName} is in ${near.name}, and ${link.device} ${link.port} is in no LAG`
-                        : `${portName} is in no LAG, and ${link.device} ${link.port} is in ${away.name}`
-                );
-            }
-
-            const here = carried(device, near.settings);
-            const there = carried(far, away.settings);
-            if (JSON.stringify(here) !== JSON.stringify(there)) {
-                report(`${near.name} carries ${describeCarried(here)}, and ${link.device} ${away.name} carries ${describeCarried(there)}`);
-            }
-
-            if (port.speed && farPort.speed && port.speed !== farPort.speed) {
-                report(`speed ${port.speed}, and ${link.device} ${link.port} is ${farPort.speed}`);
-            }
-
-            const mtu = near.settings.mtu ?? 1500;
-            const farMtu = away.settings.mtu ?? 1500;
-            if (mtu !== farMtu) report(`MTU ${mtu} on ${near.name}, and ${link.device} ${away.name} has ${farMtu}`);
-
-            const disagreement = addressDisagreement(near.settings, away.settings, far, away.name);
-            if (disagreement) report(`${near.name} ${disagreement}`);
-
-            // One VLAN under two names works, but reads as two VLANs.
-            const farNames = vlanNames(far, away.settings);
-            for (const [id, name] of vlanNames(device, near.settings)) {
-                const farName = farNames.get(id);
-                if (farName && farName !== name) report(`VLAN ${id} is ${name} here and ${farName} on ${link.device}`, "warning");
-            }
-        }
-    }
-
-    return findings;
-}
-
-/** No address is held by two devices in one VRF. Two loopbacks may hold one on purpose, for anycast, so that is a warning. */
-function checkAddresses(holders: Holder[]): Finding[] {
-    const findings: Finding[] = [];
-    const first = new Map<string, Holder>();
-
-    const isLoopback = (holder: Holder) => holder.device.interfaces?.[holder.name]?.type === "loopback";
-
-    for (const holder of holders) {
-        const key = `${holder.vrf ?? ""} ${keyOf(host(holder.address))!}`;
-        const earlier = first.get(key);
-
-        if (!earlier) {
-            first.set(key, holder);
-            continue;
-        }
-
-        // Two on one device are reported by the device's own checks.
-        if (earlier.device === holder.device) continue;
-
-        const anycast = isLoopback(earlier) && isLoopback(holder);
-
-        findings.push({
-            level: anycast ? "warning" : "error",
-            device: holder.device.name,
-            message: `${host(holder.address)} on ${holder.name} is also on ${earlier.device.name} ${earlier.name}${anycast ? ", which is right only for anycast" : ""}`,
-        });
-    }
-
-    return findings;
-}
-
-/** A BGP session to an address another of our devices holds needs that device's session back, in the AS it expects, from the address it names. */
-function checkSessions(devices: readonly Device[], owners: Map<string, Holder>): Finding[] {
-    const findings: Finding[] = [];
-
-    const sessionsOf = (device: Device) => {
-        const bgp = device.routing?.bgp;
-
-        return Object.entries(bgp?.neighbors ?? {}).map(([name, neighbor]) => {
-            const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
-
-            return {
-                name,
-                address: neighbor.address,
-                remoteAs: neighbor.remote_as ?? group?.remote_as,
-                localAddress: neighbor.local_address ?? group?.local_address,
-            };
-        });
-    };
-
-    for (const device of devices) {
-        for (const session of sessionsOf(device)) {
-            const far = owners.get(keyOf(session.address) ?? "")?.device;
-            if (!far || far === device) continue;
-
-            const report = (message: string) =>
-                findings.push({ level: "error", device: device.name, message: `neighbor ${session.name}: ${message}` });
-
-            const farBgp = far.routing?.bgp;
-            if (!farBgp) {
-                report(`${session.address} is ${far.name}'s, which runs no BGP`);
-                continue;
-            }
-
-            if (session.remoteAs !== undefined && session.remoteAs !== farBgp.asn) {
-                report(`expects AS${session.remoteAs}, and ${far.name} is AS${farBgp.asn}`);
-            }
-
-            // Two routers often hold one session per family, and a session of the other family does not answer this one.
-            const back = sessionsOf(far).find(
-                (other) =>
-                    owners.get(keyOf(other.address) ?? "")?.device === device && familyOf(other.address) === familyOf(session.address)
-            );
-            if (!back) {
-                report(`${far.name} has no session back to ${device.name}`);
-                continue;
-            }
-
-            // The far end only accepts the session from the address it names.
-            if (session.localAddress && keyOf(session.localAddress) !== keyOf(back.address)) {
-                report(`starts from ${session.localAddress}, and ${far.name}'s session ${back.name} expects ${back.address}`);
-            }
-        }
-    }
-
-    return findings;
-}
-
-/** On one segment, a VRRP id has one address and an address has one id, on every device. */
-function checkVrrp(holders: Holder[]): Finding[] {
-    const findings: Finding[] = [];
-    const bySegment = new Map<string, { holder: Holder; id: number; address: string }[]>();
-
-    for (const holder of holders) {
-        const segment = prefixOf(holder.address);
-
-        for (const group of holder.vrrp) {
-            if (!keyOf(group.address) || familyOf(group.address) !== familyOf(holder.address)) continue;
-            if (!contains(segment, group.address)) continue;
-
-            bySegment.set(segment, [...(bySegment.get(segment) ?? []), { holder, id: group.id, address: group.address }]);
-        }
-    }
-
-    for (const members of bySegment.values()) {
-        for (const member of members) {
-            const where = `${member.holder.device.name} ${member.holder.name}`;
-            const others = members.filter((other) => other.holder.device !== member.holder.device);
-
-            const sameId = others.find((other) => other.id === member.id && keyOf(other.address) !== keyOf(member.address));
-            if (sameId) {
-                findings.push({
-                    level: "error",
-                    device: member.holder.device.name,
-                    message: `VRRP ${member.id} on ${member.holder.name} is ${member.address}, and on ${sameId.holder.device.name} ${sameId.holder.name} it is ${sameId.address}`,
-                });
-            }
-
-            const sameAddress = others.find((other) => keyOf(other.address) === keyOf(member.address) && other.id !== member.id);
-            if (sameAddress) {
-                findings.push({
-                    level: "error",
-                    device: member.holder.device.name,
-                    message: `VRRP address ${member.address} is id ${member.id} on ${where}, and id ${sameAddress.id} on ${sameAddress.holder.device.name} ${sameAddress.holder.name}`,
-                });
-            }
-        }
-    }
-
-    return findings;
-}
-
-/** A GRE or VXLAN tunnel to another of our devices has a tunnel back there, with the endpoints mirrored and, for VXLAN, the same VNI and port. */
-function checkTunnels(devices: readonly Device[], owners: Map<string, Holder>): Finding[] {
-    const findings: Finding[] = [];
-
-    const ends = devices.flatMap((device) =>
-        Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) =>
-            iface.type === "gre" || iface.type === "vxlan" ? [{ device, name, iface: iface as Gre<string> | Vxlan<string> }] : []
-        )
-    );
-
-    const same = (a: string, b: string) => keyOf(a) !== undefined && keyOf(a) === keyOf(b);
-
-    for (const end of ends) {
-        const far = owners.get(keyOf(end.iface.remote) ?? "")?.device;
-        if (!far || far === end.device) continue;
-
-        const report = (message: string) =>
-            findings.push({ level: "error", device: end.device.name, message: `interface ${end.name}: ${message}` });
-        const kind = end.iface.type === "gre" ? "GRE" : "VXLAN";
-
-        // Two routers may run several VXLAN tunnels between them, one for each VNI, so a tunnel pairs with the one of its own VNI first.
-        const back = ends.filter(
-            (other) =>
-                other.device === far &&
-                other.iface.type === end.iface.type &&
-                same(other.iface.local, end.iface.remote) &&
-                same(other.iface.remote, end.iface.local)
-        );
-        const vniOf = (iface: Gre<string> | Vxlan<string>) => (iface.type === "vxlan" ? iface.vni : undefined);
-        const mirror = back.find((other) => vniOf(other.iface) === vniOf(end.iface)) ?? back[0];
-
-        if (!mirror) {
-            report(`${end.iface.remote} is ${far.name}'s, which has no ${kind} tunnel from there back to ${end.iface.local}`);
-            continue;
-        }
-
-        if (end.iface.type !== "vxlan" || mirror.iface.type !== "vxlan") continue;
-
-        if (end.iface.vni !== mirror.iface.vni) report(`VNI ${end.iface.vni}, and ${far.name} ${mirror.name} has ${mirror.iface.vni}`);
-
-        const port = end.iface.port ?? 4789;
-        const farPort = mirror.iface.port ?? 4789;
-        if (port !== farPort) report(`UDP port ${port}, and ${far.name} ${mirror.name} has ${farPort}`);
-    }
-
-    return findings;
-}

package/src/core/addr.ts

@@ -1,174 +0,0 @@
-// Address arithmetic for both families. Addresses are parsed to bigint so v4 and v6 share one code path.
-
-import type { Family } from "../schema";
-
-export const familyOf = (address: string): Family => (address.includes(":") ? "ipv6" : "ipv4");
-
-const bitsOf = (family: Family) => (family === "ipv4" ? 32 : 128);
-
-/** An address as a number, or null when it is not one. */
-export function parse(address: string): bigint | null {
-    if (!address.includes(":")) {
-        const octets = address.split(".");
-        const valid = octets.length === 4 && octets.every((octet) => /^\d{1,3}$/.test(octet) && Number(octet) <= 255);
-        if (!valid) return null;
-
-        return octets.reduce((value, octet) => (value << 8n) | BigInt(octet), 0n);
-    }
-
-    const [before, after, extra] = address.split("::");
-    if (extra !== undefined) return null;
-
-    const groupsOf = (text: string | undefined) => (text ? text.split(":") : []);
-    const leading = groupsOf(before);
-    const trailing = groupsOf(after);
-
-    // `::` stands for as many zero groups as make eight.
-    const zeros = after === undefined ? 0 : 8 - leading.length - trailing.length;
-    const groups = [...leading, ...Array(zeros).fill("0"), ...trailing];
-
-    const valid = groups.length === 8 && groups.every((group) => /^[0-9a-fA-F]{1,4}$/.test(group));
-    if (!valid) return null;
-
-    return groups.reduce((value, group) => (value << 16n) | BigInt(parseInt(group, 16)), 0n);
-}
-
-/** `10.0.0.1/24` to its parts. Throws when it is not an address with a length. */
-export function split(cidr: string): { addr: string; len: number; family: Family } {
-    const [address, lengthText] = cidr.split("/");
-    const family = familyOf(address!);
-    const length = Number(lengthText);
-
-    const valid =
-        parse(address!) !== null && lengthText !== undefined && Number.isInteger(length) && length >= 0 && length <= bitsOf(family);
-    if (!valid) throw new Error(`'${cidr}' is not an address with a length`);
-
-    return { addr: address!, len: length, family };
-}
-
-export const isAddress = (text: string) => parse(text) !== null;
-
-export function isCidr(text: string): boolean {
-    try {
-        split(text);
-        return true;
-    } catch {
-        return false;
-    }
-}
-
-const mask = (length: number, family: Family) => {
-    const all = (1n << BigInt(bitsOf(family))) - 1n;
-    const hostBits = (1n << BigInt(bitsOf(family) - length)) - 1n;
-    return all ^ hostBits;
-};
-
-function format(value: bigint, family: Family): string {
-    if (family === "ipv4") {
-        return [24n, 16n, 8n, 0n].map((shift) => String((value >> shift) & 255n)).join(".");
-    }
-
-    const groups = Array.from({ length: 8 }, (_, index) => ((value >> BigInt(112 - index * 16)) & 0xffffn).toString(16));
-
-    // Compress the longest run of zero groups, as RFC 5952 asks.
-    let longestStart = -1;
-    let longestLength = 0;
-
-    for (let start = 0; start < 8;) {
-        let end = start;
-        while (end < 8 && groups[end] === "0") end++;
-
-        const runLength = end - start;
-        if (runLength > longestLength && runLength > 1) {
-            longestStart = start;
-            longestLength = runLength;
-        }
-
-        start = end === start ? start + 1 : end;
-    }
-
-    if (longestStart < 0) return groups.join(":");
-
-    const head = groups.slice(0, longestStart).join(":");
-    const tail = groups.slice(longestStart + longestLength).join(":");
-    return `${head}::${tail}`;
-}
-
-/** `10.0.0.1/24` to `10.0.0.0/24`. */
-export function network(cidr: string): string {
-    const { addr, len, family } = split(cidr);
-    return `${format(parse(addr)! & mask(len, family), family)}/${len}`;
-}
-
-/** Is the address or prefix `inner` inside `outer`? */
-export function contains(outer: string, inner: string): boolean {
-    const outerParts = split(outer);
-    const [innerAddress, innerLengthText] = inner.split("/");
-    if (familyOf(innerAddress!) !== outerParts.family) return false;
-
-    const innerLength = innerLengthText === undefined ? bitsOf(outerParts.family) : Number(innerLengthText);
-    if (innerLength < outerParts.len) return false;
-
-    const outerMask = mask(outerParts.len, outerParts.family);
-    return (parse(innerAddress!)! & outerMask) === (parse(outerParts.addr)! & outerMask);
-}
-
-/** A number back to the address it stands for. */
-export const formatAddress = (value: bigint, family: Family) => format(value, family);
-
-/** The first and last address of a prefix, as numbers. */
-export function rangeOf(cidr: string): { first: bigint; last: bigint; family: Family } {
-    const { addr, len, family } = split(cidr);
-    const hostBits = mask(len, family) ^ ((1n << BigInt(bitsOf(family))) - 1n);
-    const first = parse(addr)! & mask(len, family);
-
-    return { first, last: first | hostBits, family };
-}
-
-/** The fewest prefixes that cover every address from `first` to `last` and nothing else. */
-export function prefixesBetween(first: bigint, last: bigint, family: Family): string[] {
-    const bits = bitsOf(family);
-    const prefixes: string[] = [];
-
-    for (let start = first; start <= last;) {
-        // The largest block that starts here on its own boundary and does not pass `last`.
-        let size = 0;
-        while (size < bits && start % (1n << BigInt(size + 1)) === 0n && start + (1n << BigInt(size + 1)) - 1n <= last) size++;
-
-        prefixes.push(`${format(start, family)}/${bits - size}`);
-        start += 1n << BigInt(size);
-    }
-
-    return prefixes;
-}
-
-/** `/25` to `255.255.255.128`. */
-export const netmask = (length: number) => format(mask(length, "ipv4"), "ipv4");
-
-/** `/24` to `0.0.0.255`, the inverted mask some ACLs take. */
-export const wildcard = (length: number) => format(mask(length, "ipv4") ^ 0xffffffffn, "ipv4");
-
-/** The address with its length dropped. */
-export const host = (cidr: string) => cidr.split("/")[0]!;
-
-/** IPv4 space another network cannot reach: this host, private, shared, loopback, link-local and documentation, after RFC 6890. */
-const NOT_GLOBAL_V4 = [
-    "0.0.0.0/8",
-    "10.0.0.0/8",
-    "100.64.0.0/10",
-    "127.0.0.0/8",
-    "169.254.0.0/16",
-    "172.16.0.0/12",
-    "192.0.2.0/24",
-    "192.168.0.0/16",
-    "198.18.0.0/15",
-    "198.51.100.0/24",
-    "203.0.113.0/24",
-];
-
-/** Whether another network can reach the address. IPv6 is global only inside 2000::/3, less documentation space. */
-export function isGlobal(address: string): boolean {
-    if (familyOf(address) === "ipv6") return contains("2000::/3", address) && !contains("2001:db8::/32", address);
-
-    return !NOT_GLOBAL_V4.some((prefix) => contains(prefix, address));
-}