@takodotid/circuit 0.34.3 → 0.36.0

package/src/helpers/bgp.ts

@@ -0,0 +1,301 @@
+import type { Community } from "../core/define";
+import type { Device, LargeCommunityPattern, PolicyRule, Prefix, StandardCommunity, StandardCommunityPattern } from "../schema";
+
+/** The prefix lengths a BGP import accepts. */
+export type SanityLengths = {
+    /** Shortest and longest IPv4 prefix accepted. /8 to /24 when absent. */
+    ipv4?: { min: number; max: number };
+    /** Shortest and longest IPv6 prefix accepted. /16 to /48 when absent. */
+    ipv6?: { min: number; max: number };
+};
+
+/** Kinds of neighbor and the number each is tagged with, such as `{ transit: 1, customer: 3 }`. */
+export type CommunityClasses = Readonly<Record<string, number>>;
+
+/**
+ * A BGP community scheme of large communities, `asn:function:parameter`, in the style of RFC 8195. Each field names the function number your network uses for it; leave out what your network does not offer.
+ *
+ * The type parameters keep the exact numbers you write, so the communities `Bgp.communityScheme` gives back show them in the editor: Asn your AS, LearnedFrom the function of `learned_from`, Classes its classes.
+ */
+export type CommunityScheme<
+    Asn extends number = number,
+    LearnedFrom extends number = number,
+    Classes extends CommunityClasses = CommunityClasses,
+> = {
+    /** Your AS. It is the first part of every community. */
+    asn: Asn;
+    /** Set on import: the kind of neighbor a route came from, `asn:function:class`. */
+    learned_from?: { function: LearnedFrom; classes: Classes };
+    /** Set on import: the site a route was learned at, `asn:function:site`. `sites` names the sites, for the catalogue. */
+    learned_at?: { function: number; sites?: Readonly<Record<number, string>> };
+    /** Set on import: the AS a route was learned from, `asn:function:asn`. */
+    learned_from_as?: number;
+    /** A neighbor asks: do not announce the route to an AS, `asn:function:asn`, or to anyone, `asn:function:0`. */
+    do_not_announce?: number;
+    /** A neighbor asks: prepend toward an AS once, twice or three times, `asn:function:asn`. */
+    prepend?: { once?: number; twice?: number; three_times?: number };
+    /**
+     * A neighbor asks: drop all traffic to this route, `asn:function:0`, usually one address under attack. Your router drops it, and so does every upstream in `upstreams`.
+     *
+     * `upstreams` maps an upstream's AS to its own blackhole community, as its NOC gives it. The route is passed to that upstream with it, so the traffic stops before it reaches your links. An upstream not listed never receives the route.
+     */
+    blackhole?: { function: number; upstreams?: Readonly<Record<number, StandardCommunity>> };
+};
+
+/** The class names a scheme declares, or any name when it declares none. */
+type ClassName<Classes extends CommunityClasses> = {} extends Classes ? string : Extract<keyof Classes, string>;
+
+/** BGP policy: an import sanity policy, a community scheme, and helpers that read a device's BGP neighbors. */
+export class Bgp {
+    private static readonly PREPENDS = [
+        ["once", 1],
+        ["twice", 2],
+        ["three_times", 3],
+    ] as const;
+
+    /** Route policy rules rejecting what no neighbor should send: prefixes too short or too long for the global table, and RPKI invalid. Place it first in an import, or as a policy other imports call. */
+    static sanity(lengths: SanityLengths = {}): PolicyRule<never, never>[] {
+        const ipv4 = lengths.ipv4 ?? { min: 8, max: 24 };
+        const ipv6 = lengths.ipv6 ?? { min: 16, max: 48 };
+
+        return [
+            {
+                description: `IPv4 shorter than /${ipv4.min}`,
+                match: { family: "ipv4", prefix_length: { max: ipv4.min - 1 } },
+                action: "reject",
+            },
+            {
+                description: `IPv4 longer than /${ipv4.max}`,
+                match: { family: "ipv4", prefix_length: { min: ipv4.max + 1 } },
+                action: "reject",
+            },
+            {
+                description: `IPv6 shorter than /${ipv6.min}`,
+                match: { family: "ipv6", prefix_length: { max: ipv6.min - 1 } },
+                action: "reject",
+            },
+            {
+                description: `IPv6 longer than /${ipv6.max}`,
+                match: { family: "ipv6", prefix_length: { min: ipv6.max + 1 } },
+                action: "reject",
+            },
+            { description: "RPKI invalid", match: { rpki: "invalid" }, action: "reject" },
+        ];
+    }
+
+    /** Each BGP neighbor's own policies and role, or its group's. */
+    static neighborPolicies(device: Device) {
+        const bgp = device.routing?.bgp;
+
+        return Object.entries(bgp?.neighbors ?? {}).map(([name, neighbor]) => {
+            const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
+
+            return {
+                name,
+                address: neighbor.address,
+                role: neighbor.role ?? group?.role,
+                import: neighbor.import ?? group?.import,
+                export: neighbor.export ?? group?.export,
+            };
+        });
+    }
+
+    /** The prefixes an export policy accepts by name. */
+    static offered(device: Device, policy: string | undefined): Prefix[] {
+        const rules = policy ? (device.policies?.[policy] ?? []) : [];
+        return rules.filter((rule) => rule.action === "accept" && rule.match?.prefix).map((rule) => rule.match!.prefix!);
+    }
+
+    /**
+     * Policy rules and a catalogue from one community scheme, so the communities your routers set, the ones they act on, and the ones you publish never disagree.
+     *
+     * - `tag(neighborClass, neighborAs, { site, trusted })`: a rule for an import policy. It removes your communities a neighbor set, then adds where the route was learned. A `trusted` neighbor keeps its requests: do not announce, prepend, blackhole. `site` is needed when the scheme has `learned_at`.
+     * - `actions(neighborAs, { blackhole })`: rules for an export policy toward one neighbor. They act on a customer's action communities, then remove all of yours. Place them before the rules that accept. A blackholed route goes no further, unless `blackhole` names the neighbor's own blackhole community: then it is passed on with it, so the neighbor drops the traffic too.
+     * - `blackhole(prefixSets)`: rules for the import policy of a neighbor you trust with blackholes, before anything that rejects long prefixes. They take a route the neighbor asked to blackhole, but only inside `prefixSets`, its own space, and drop traffic to it here. One rule per set, so one call covers both families.
+     * - `catalogue`: every community, for `communities` in `defineNetwork`.
+     * - `community(fn, parameter)`: one community of yours, for a rule of your own.
+     * - `learned_from`: the community each class is tagged with, by class name, such as `learned_from.customer`.
+     */
+    static communityScheme<
+        const Asn extends number,
+        const LearnedFrom extends number = number,
+        const Classes extends CommunityClasses = {},
+    >(scheme: CommunityScheme<Asn, LearnedFrom, Classes>) {
+        type Class = ClassName<Classes>;
+
+        const { asn } = scheme;
+
+        /** One community of yours, `asn:fn:parameter`. */
+        const community = <const Fn extends number, const Parameter extends number>(fn: Fn, parameter: Parameter) =>
+            `${asn}:${fn}:${parameter}` as `${Asn}:${Fn}:${Parameter}`;
+
+        /** Every value of one of your functions, `asn:fn:*`, for a list of communities to remove. */
+        const anyOf = (fn: number): LargeCommunityPattern => `${asn}:${fn}:*`;
+
+        /** A line of the catalogue, where `nnn` stands for any number. */
+        const written = (fn: number, parameter: number | string) => `${asn}:${fn}:${parameter}`;
+
+        const ours = {
+            standard: [`${asn}:*`] as StandardCommunityPattern[],
+            large: [`${asn}:*:*`] as LargeCommunityPattern[],
+        };
+
+        const learnedFrom = Object.fromEntries(
+            Object.entries<number>(scheme.learned_from?.classes ?? {}).map(([name, value]) => [
+                name,
+                community(scheme.learned_from!.function, value),
+            ])
+        ) as { readonly [Name in keyof Classes]: `${Asn}:${LearnedFrom}:${Classes[Name]}` };
+
+        const information = [scheme.learned_from?.function, scheme.learned_at?.function, scheme.learned_from_as].filter(
+            (fn): fn is number => fn !== undefined
+        );
+
+        const tag = (
+            neighborClass: Class,
+            neighborAs: number,
+            options: { site?: number; trusted?: boolean } = {}
+        ): PolicyRule<never, never> => {
+            const { site, trusted = false } = options;
+            if (scheme.learned_at && site === undefined)
+                throw new Error(`Bgp.communityScheme: tag for AS${neighborAs} needs a site, for learned_at`);
+
+            return {
+                description: `Learned from AS${neighborAs}`,
+                set: {
+                    remove_communities: ours.standard,
+                    // A trusted neighbor keeps its requests and loses only the "where it came from" tags, which are ours to set. Anyone else loses every community of ours.
+                    remove_large_communities: trusted ? information.map(anyOf) : ours.large,
+                    add_large_communities: [
+                        ...(scheme.learned_from
+                            ? [community(scheme.learned_from.function, scheme.learned_from.classes[neighborClass])]
+                            : []),
+                        ...(scheme.learned_at ? [community(scheme.learned_at.function, site!)] : []),
+                        ...(scheme.learned_from_as !== undefined ? [community(scheme.learned_from_as, neighborAs)] : []),
+                    ],
+                },
+            };
+        };
+
+        const blackhole = <S extends string>(prefixSets: readonly S[]): PolicyRule<never, S>[] => {
+            const fn = scheme.blackhole?.function;
+            if (fn === undefined) throw new Error("Bgp.communityScheme: blackhole needs a function number in the scheme");
+
+            return prefixSets.map((prefixSet) => ({
+                description: "Blackhole, asked by the neighbor",
+                match: { large_community: community(fn, 0), prefix_set: prefixSet },
+                set: { blackhole: true },
+                action: "accept",
+            }));
+        };
+
+        const actions = (neighborAs: number): PolicyRule<never, never>[] => {
+            // The upstream's own blackhole community, when it takes blackholes from us.
+            const passOn = scheme.blackhole?.upstreams?.[neighborAs];
+
+            return [
+                ...(scheme.blackhole !== undefined && !passOn
+                    ? [
+                          {
+                              description: "Blackholed here, never announced",
+                              match: { large_community: community(scheme.blackhole.function, 0) },
+                              action: "reject" as const,
+                          },
+                      ]
+                    : []),
+                ...(scheme.do_not_announce !== undefined
+                    ? [
+                          {
+                              description: "Asked not to be announced anywhere",
+                              match: { large_community: community(scheme.do_not_announce, 0) },
+                              action: "reject" as const,
+                          },
+                          {
+                              description: `Asked not to be announced to AS${neighborAs}`,
+                              match: { large_community: community(scheme.do_not_announce, neighborAs) },
+                              action: "reject" as const,
+                          },
+                      ]
+                    : []),
+                ...(scheme.blackhole !== undefined && passOn
+                    ? [
+                          {
+                              description: `Blackhole passed on to AS${neighborAs}`,
+                              match: { large_community: community(scheme.blackhole.function, 0) },
+                              set: {
+                                  remove_communities: ours.standard,
+                                  remove_large_communities: ours.large,
+                                  add_communities: [passOn],
+                              },
+                              action: "accept" as const,
+                          },
+                      ]
+                    : []),
+                ...Bgp.PREPENDS.flatMap(([name, times]) => {
+                    const fn = scheme.prepend?.[name];
+                    if (fn === undefined) return [];
+
+                    return [
+                        {
+                            description: `Asked to prepend ${name.replace("_", " ")} to AS${neighborAs}`,
+                            match: { large_community: community(fn, neighborAs) },
+                            set: { prepend: times },
+                        },
+                    ];
+                }),
+                {
+                    description: "Our communities stay inside our network",
+                    set: { remove_communities: ours.standard, remove_large_communities: ours.large },
+                },
+            ];
+        };
+
+        const catalogue: Community[] = [
+            ...Object.entries<number>(scheme.learned_from?.classes ?? {}).map(([name, value]) => ({
+                community: written(scheme.learned_from!.function, value),
+                description: `Learned from ${Bgp.article(name)}`,
+            })),
+            ...(scheme.learned_at
+                ? [
+                      ...Object.entries(scheme.learned_at.sites ?? {}).map(([site, name]) => ({
+                          community: written(scheme.learned_at!.function, site),
+                          description: `Learned in ${name}`,
+                      })),
+                      { community: written(scheme.learned_at.function, "nnn"), description: "Learned at site $0" },
+                  ]
+                : []),
+            ...(scheme.learned_from_as !== undefined
+                ? [{ community: written(scheme.learned_from_as, "nnn"), description: "Learned from AS$0" }]
+                : []),
+            ...(scheme.do_not_announce !== undefined
+                ? [
+                      { community: written(scheme.do_not_announce, 0), description: "Do not announce to anyone" },
+                      { community: written(scheme.do_not_announce, "nnn"), description: "Do not announce to AS$0" },
+                  ]
+                : []),
+            ...Bgp.PREPENDS.flatMap(([name]) => {
+                const fn = scheme.prepend?.[name];
+                return fn === undefined
+                    ? []
+                    : [{ community: written(fn, "nnn"), description: `Prepend ${name.replace("_", " ")} to AS$0` }];
+            }),
+            ...(scheme.blackhole !== undefined
+                ? [
+                      {
+                          community: written(scheme.blackhole.function, 0),
+                          description: Object.keys(scheme.blackhole.upstreams ?? {}).length
+                              ? `Blackhole: dropped in AS${asn} and by its upstreams that take it`
+                              : `Blackhole: dropped in AS${asn}, not announced further`,
+                      },
+                  ]
+                : []),
+        ];
+
+        return { community, learned_from: learnedFrom, tag, actions, blackhole, catalogue };
+    }
+
+    /** A word with its article: "a customer", "an upstream". */
+    private static article(word: string): string {
+        return /^[aeiou]/i.test(word) ? `an ${word}` : `a ${word}`;
+    }
+}

package/src/helpers/checks.ts

@@ -0,0 +1,178 @@
+import { Address } from "../core/address";
+import type { Check, Finding } from "../core/define";
+import { Bgp } from "./bgp";
+
+/** Where traffic from outside, before anything filters it, may go. Every VLAN not listed as untrusted is trusted, so a VLAN added later is protected without being listed. */
+export type TrustBoundary = {
+    /** VLANs carrying traffic straight from outside: transits, exchanges, an ISP handoff. */
+    untrusted: readonly string[];
+    /** The devices that filter: the only ones that may give an untrusted VLAN an address, and the only ones a port carrying both kinds may face. */
+    routers: readonly string[];
+    /**
+     * Links between two switches that may carry both kinds, each named by its two devices: a site's switch extended to another building, with an exchange's VLAN and its own management on one cable. Neither end gives an untrusted VLAN an address.
+     */
+    extended?: readonly (readonly [string, string])[];
+};
+
+/** Checks for `checks` in `defineNetwork`, and helpers for checks of your own. */
+export class Checks {
+    /**
+     * Every BGP export ends in a reject that matches everything, so nothing leaves by accident. An export to a neighbor whose `role` is `customer` is left out: sending a customer everything you know is what it pays for, and cannot leak a route to the rest of the internet.
+     */
+    static readonly exportsEndInReject: Check = (devices) => {
+        const findings: Finding[] = [];
+
+        for (const device of devices) {
+            for (const neighbor of Bgp.neighborPolicies(device)) {
+                if (neighbor.role === "customer") continue;
+
+                const last = neighbor.export ? device.policies?.[neighbor.export]?.at(-1) : undefined;
+
+                if (neighbor.export && (last?.action !== "reject" || last.match)) {
+                    findings.push({
+                        level: "error",
+                        device: device.name,
+                        message: `${neighbor.name}: export ${neighbor.export} does not end in an unconditional reject`,
+                    });
+                }
+            }
+        }
+
+        return findings;
+    };
+
+    /** A GRE or VXLAN tunnel's local address is outside what the neighbors over it are offered, or their replies route back into the tunnel. */
+    static readonly tunnelsOutsideOffered: Check = (devices) => {
+        const findings: Finding[] = [];
+
+        for (const device of devices) {
+            for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+                if (iface.type !== "gre" && iface.type !== "vxlan") continue;
+
+                const subnets = (iface.addresses ?? []).map((entry) => (typeof entry === "string" ? entry : entry.address));
+
+                for (const neighbor of Bgp.neighborPolicies(device)) {
+                    if (!subnets.some((subnet) => Address.contains(subnet, neighbor.address))) continue;
+
+                    for (const prefix of Bgp.offered(device, neighbor.export)) {
+                        if (Address.contains(prefix, iface.local)) {
+                            findings.push({
+                                level: "error",
+                                device: device.name,
+                                message: `${name} is sourced from ${iface.local}, inside ${prefix}, which ${neighbor.name} is offered`,
+                            });
+                        }
+                    }
+                }
+            }
+        }
+
+        return findings;
+    };
+
+    /**
+     * A native VLAN is a dead end: native on one trunk (a port or a LAG) of a device at most, and never an access VLAN or a tagged VLAN anywhere on that device. On a switch, a native VLAN is an untagged member of every trunk it is native on, so one native VLAN shared by two trunks joins them: every untagged frame from one leaves on the other.
+     */
+    static readonly nativeVlansAreDeadEnds: Check = (devices) => {
+        const findings: Finding[] = [];
+
+        for (const device of devices) {
+            const carriers = [
+                ...Object.entries(device.ports ?? {}).flatMap(([name, port]) => (port ? [{ what: `port ${name}`, settings: port }] : [])),
+                ...Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) =>
+                    iface.type === "lag" ? [{ what: `LAG ${name}`, settings: iface }] : []
+                ),
+            ];
+
+            const nativeOn = new Map<string, string[]>();
+            for (const { what, settings } of carriers) {
+                if (settings.native_vlan) nativeOn.set(settings.native_vlan, [...(nativeOn.get(settings.native_vlan) ?? []), what]);
+            }
+
+            for (const [vlan, trunks] of nativeOn) {
+                const report = (message: string) =>
+                    findings.push({ level: "error", device: device.name, message: `native VLAN ${vlan} ${message}` });
+
+                if (trunks.length > 1) report(`is native on ${trunks.join(", ")}: give each trunk its own`);
+
+                const members = carriers.filter(({ settings }) => Checks.vlansOf(settings).includes(vlan));
+                for (const { what } of members) report(`is also an access or tagged VLAN on ${what}`);
+            }
+        }
+
+        return findings;
+    };
+
+    /** The VLANs a port carries, untagged or tagged. */
+    static vlansOf(port: { access_vlan?: string; trunk_vlans?: readonly string[] }): string[] {
+        return [port.access_vlan, ...(port.trunk_vlans ?? [])].filter((vlan): vlan is string => vlan !== undefined);
+    }
+
+    /** A check: traffic from outside reaches your own VLANs only through a router. A port or LAG carrying an untrusted VLAN beside any other is on a router or faces one, and only a router gives an untrusted VLAN an address. */
+    static trustBoundary(boundary: TrustBoundary): Check {
+        return (devices) => {
+            const untrusted = new Set(boundary.untrusted);
+            const routers = new Set(boundary.routers);
+            const extended = (a: string, b: string) =>
+                (boundary.extended ?? []).some(([x, y]) => (x === a && y === b) || (x === b && y === a));
+            const findings: Finding[] = [];
+
+            for (const device of devices) {
+                const isRouter = routers.has(device.name);
+                const ports = Object.entries(device.ports ?? {}).flatMap(([name, port]) => (port ? [{ name, port }] : []));
+
+                // What carries VLANs: a port on its own, or a LAG, which faces whatever its members link to.
+                const carriers = [
+                    ...ports
+                        .filter(({ port }) => !port.lag)
+                        .map(({ name, port }) => ({
+                            what: `port ${name}`,
+                            carried: Checks.vlansOf(port),
+                            faces: port.link ? [port.link.device] : [],
+                        })),
+                    ...Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) =>
+                        iface.type === "lag"
+                            ? [
+                                  {
+                                      what: `LAG ${name}`,
+                                      carried: Checks.vlansOf(iface),
+                                      faces: ports
+                                          .filter(({ port }) => port.lag === name && port.link)
+                                          .map(({ port }) => port.link!.device),
+                                  },
+                              ]
+                            : []
+                    ),
+                ];
+
+                for (const { what, carried, faces } of carriers) {
+                    const mixes = carried.some((vlan) => untrusted.has(vlan)) && carried.some((vlan) => !untrusted.has(vlan));
+                    const facesRouter = isRouter || faces.some((name) => routers.has(name));
+                    const isExtension = faces.length > 0 && faces.every((name) => extended(device.name, name));
+
+                    if (mixes && !facesRouter && !isExtension) {
+                        findings.push({
+                            level: "error",
+                            device: device.name,
+                            message: `${what} carries an untrusted VLAN beside a trusted one and does not face a router`,
+                        });
+                    }
+                }
+
+                if (isRouter) continue;
+
+                for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+                    if (iface.type === "vlan" && untrusted.has(iface.vlan)) {
+                        findings.push({
+                            level: "error",
+                            device: device.name,
+                            message: `interface ${name} puts an address on untrusted VLAN ${iface.vlan}; only a router may`,
+                        });
+                    }
+                }
+            }
+
+            return findings;
+        };
+    }
+}

package/src/helpers/exchange.ts

@@ -0,0 +1,117 @@
+import { Address } from "../core/address";
+import type { Check, Finding } from "../core/define";
+import type { Ethertype, IP, Port, Prefix } from "../schema";
+import { Checks } from "./checks";
+import { RouteServerConfig, type RouteServer } from "./route-server";
+
+/** A member of an internet exchange: a network with a port on the fabric and an address on the peering LAN. */
+export type ExchangeMember = {
+    /** Lowercase, and never reused. */
+    name: string;
+    asn: number;
+    /** The member's port on each fabric switch, by switch name. */
+    ports: Readonly<Record<string, string>>;
+    /** Its addresses on the peering LAN. The route servers peer with these. */
+    ipv4?: IP;
+    ipv6?: IP;
+};
+
+/** An internet exchange's peering LAN, as its fabric carries it. */
+export type InternetExchange<V extends string> = {
+    /** The peering VLAN, by the name the fabric switches give it. */
+    vlan: V;
+    /** The peering LAN's subnets. */
+    lan: { ipv4?: Prefix; ipv6?: Prefix };
+    /** Addresses on the peering LAN no member may take, such as the route servers'. */
+    reserved?: readonly IP[];
+    /** How much broadcast, multicast and unknown unicast a member port lets through, in percent of its speed. 1 when absent. */
+    storm_percent?: number;
+    /** The most MAC addresses a member port learns, usually 1. No limit when absent. No platform renders it yet, so `validate` refuses it. */
+    mac_limit?: number;
+    /** The only kinds of frame a member port takes in, usually `ipv4`, `ipv6` and `arp`. Every kind when absent. No platform renders it yet, so `validate` refuses it. */
+    ethertypes?: readonly Ethertype[];
+};
+
+/** An internet exchange's fabric: its member ports, a check of its members, and its route servers' config. */
+export class Exchange {
+    /**
+     * Member ports and a check for an internet exchange's fabric.
+     *
+     * - `ports(device)`: every member's port on one switch. A member port is in the peering VLAN and nothing else, takes no part in spanning tree or LLDP, and lets only a trickle of broadcast, multicast and unknown unicast through. With `mac_limit` and `ethertypes`, it also learns that many MAC addresses at most and takes in only those kinds of frame.
+     * - `check`: members never share a name, an AS, an address or a port; every address is inside the peering LAN and not reserved; every member port carries the peering VLAN alone.
+     * - `bird(server)`: one route server's BIRD 2 config, with a session to every member. Write it to a file for the server; Circuit never logs in to a route server.
+     * - `openbgpd(server)`: the same route server's config for OpenBGPD, its `bgpd.conf`, with the same sessions and the same rules.
+     */
+    static build<const V extends string>(exchange: InternetExchange<V>, members: readonly ExchangeMember[]) {
+        const percent = exchange.storm_percent ?? 1;
+
+        const ports = (device: string) => {
+            const result: Record<string, Port<V, string, string, string>> = {};
+
+            for (const member of members) {
+                const port = member.ports[device];
+                if (!port) continue;
+
+                result[port] = {
+                    description: `${member.name}, AS${member.asn}`,
+                    access_vlan: exchange.vlan,
+                    stp: false,
+                    lldp: false,
+                    storm_control: { broadcast: { percent }, multicast: { percent }, unknown_unicast: { percent } },
+                    ...(exchange.mac_limit !== undefined ? { mac_limit: exchange.mac_limit } : {}),
+                    ...(exchange.ethertypes ? { ethertypes: exchange.ethertypes } : {}),
+                };
+            }
+
+            return result;
+        };
+
+        const check: Check = (devices) => {
+            const findings: Finding[] = [];
+            const error = (message: string, device?: string) => findings.push({ level: "error", ...(device ? { device } : {}), message });
+            const taken = new Map<string, string>((exchange.reserved ?? []).map((address) => [address, "reserved"]));
+            // `ports()` writes one port per name, so a second member on a port would silently replace the first.
+            const portHolders = new Map<string, string>();
+
+            members.forEach((member, index) => {
+                for (const other of members.slice(index + 1)) {
+                    if (other.name === member.name) error(`member ${member.name} is declared twice`);
+                    if (other.asn === member.asn) error(`members ${member.name} and ${other.name} share AS${member.asn}`);
+                }
+
+                for (const [address, lan] of [
+                    [member.ipv4, exchange.lan.ipv4],
+                    [member.ipv6, exchange.lan.ipv6],
+                ] as const) {
+                    if (!address) continue;
+                    if (!lan || !Address.contains(lan, address)) error(`${address} of ${member.name} is outside the peering LAN`);
+
+                    const holder = taken.get(address);
+                    if (holder) error(`${address} of ${member.name} is already ${holder === "reserved" ? "reserved" : `${holder}'s`}`);
+                    taken.set(address, member.name);
+                }
+
+                for (const [deviceName, portName] of Object.entries(member.ports)) {
+                    const holder = portHolders.get(`${deviceName} ${portName}`);
+                    if (holder) error(`port ${portName} is given to both ${holder} and ${member.name}`, deviceName);
+                    portHolders.set(`${deviceName} ${portName}`, member.name);
+
+                    const device = devices.find((candidate) => candidate.name === deviceName);
+                    const port = device?.ports?.[portName as keyof typeof device.ports];
+                    const carried = port ? Checks.vlansOf(port) : [];
+
+                    if (carried.length !== 1 || carried[0] !== exchange.vlan) {
+                        error(`port ${portName} of ${member.name} does not carry the peering VLAN alone`, deviceName);
+                    }
+                }
+            });
+
+            return findings;
+        };
+
+        const bird = (server: RouteServer) => RouteServerConfig.bird(server, exchange.lan, members);
+        const openbgpd = (server: RouteServer) => RouteServerConfig.openbgpd(server, exchange.lan, members);
+
+        return { ports, check, bird, openbgpd };
+    }
+}