@takodotid/circuit 0.4.3

package/src/adapters/devices/vrp/models.ts

@@ -0,0 +1,4 @@
+// Port counts per speed class, and how the platform spells a port. `{n}` is the position within the class.
+export const models = {
+    "CE6855-48S6Q-HI": { ports: { "10g": 48, "40g": 6 }, spelling: { "10g": "10GE1/0/{n}", "40g": "40GE1/0/{n}" } },
+} as const;

package/src/adapters/registries/index.ts

@@ -0,0 +1,19 @@
+// Registries the framework reads prefix sets from. PeeringDB, which it publishes to, is in ./peeringdb.ts.
+
+import type { Family } from "../../schema";
+import type { Registry } from "../../schema/policy";
+
+/** Prefixes an origin AS announces, from RIPEstat. */
+async function ripeStat(query: string, family: Family): Promise<string[]> {
+    if (!/^AS\d+$/i.test(query)) throw new Error(`ripe-stat takes an AS number, got '${query}'`);
+    const res = await fetch(`https://stat.ripe.net/data/announced-prefixes/data.json?resource=${query.toUpperCase()}`, {
+        signal: AbortSignal.timeout(90_000),
+    });
+    if (!res.ok) throw new Error(`ripe-stat answered ${res.status}`);
+    const data = (await res.json()) as { data: { prefixes: { prefix: string }[] } };
+    return [
+        ...new Set(data.data.prefixes.map((entry) => entry.prefix).filter((entry) => entry.includes(":") === (family === "ipv6"))),
+    ].sort();
+}
+
+export const registries: Record<Registry, (query: string, family: Family) => Promise<string[]>> = { "ripe-stat": ripeStat };

package/src/adapters/registries/peeringdb.ts

@@ -0,0 +1,169 @@
+// Keeps a network's exchange presence at PeeringDB in step with the config. Each interface with an `exchange` naming a `peeringdb_ixlan` is one record.
+//
+// Only globally reachable addresses are published: an exchange reached over a tunnel often lands on private or shared space, and publishing it would point others at a dead end. A record the config does not hold is reported, never deleted, and `operational` is never changed, since leaving an exchange is a decision made outside the config.
+
+import { contains, familyOf, host, isGlobal } from "../../core/addr";
+import type { Network } from "../../core/define";
+import { resolve } from "../../core/secrets";
+import type { Device, Interface } from "../../schema";
+
+const API = "https://www.peeringdb.com/api";
+
+/** A network's presence at one exchange LAN, as PeeringDB holds it. */
+type NetIxLan = {
+    id: number;
+    net_id: number;
+    ixlan_id: number;
+    name: string;
+    speed: number;
+    ipaddr4: string | null;
+    ipaddr6: string | null;
+    is_rs_peer: boolean;
+    operational: boolean;
+};
+
+/** One record as the config describes it. */
+type Wanted = {
+    name: string;
+    ixlan_id: number;
+    speed: number;
+    ipaddr4: string | null;
+    ipaddr6: string | null;
+    is_rs_peer: boolean;
+};
+
+/** A change to send. `id` is set when the record exists and is updated in place. */
+export type PeeringDbChange = {
+    summary: string;
+    id?: number;
+    body: Record<string, unknown>;
+};
+
+export type PeeringDbPlan = {
+    changes: PeeringDbChange[];
+    /** Records PeeringDB holds that the config does not. */
+    unknown: string[];
+};
+
+type AnyInterface = Interface<string, string>;
+
+const addressesOf = (iface: AnyInterface) => (iface.addresses ?? []).map((entry) => (typeof entry === "string" ? entry : entry.address));
+
+/** Whether the device peers with a route server on this interface's subnets. */
+function peersWithRouteServer(device: Device, iface: AnyInterface): boolean {
+    const bgp = device.routing?.bgp;
+    const subnets = addressesOf(iface);
+
+    return Object.values(bgp?.neighbors ?? {}).some((neighbor) => {
+        const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
+        const role = neighbor.local_role ?? group?.local_role;
+        return role === "rs-client" && subnets.some((subnet) => contains(subnet, neighbor.address));
+    });
+}
+
+/** Every exchange presence the config declares with a PeeringDB exchange LAN. */
+function wanted(network: Network): Wanted[] {
+    const records: Wanted[] = [];
+
+    for (const device of network.devices) {
+        for (const iface of Object.values(device.interfaces ?? {})) {
+            const exchange = iface.exchange;
+            if (!exchange?.peeringdb_ixlan) continue;
+
+            const published = addressesOf(iface).map(host).filter(isGlobal);
+
+            records.push({
+                name: exchange.name,
+                ixlan_id: exchange.peeringdb_ixlan,
+                speed: exchange.speed,
+                ipaddr4: published.find((address) => familyOf(address) === "ipv4") ?? null,
+                ipaddr6: published.find((address) => familyOf(address) === "ipv6") ?? null,
+                is_rs_peer: peersWithRouteServer(device, iface),
+            });
+        }
+    }
+
+    return records;
+}
+
+/** What would change at PeeringDB. Reads the public API; needs no key. */
+export async function planPeeringDb(network: Network): Promise<PeeringDbPlan> {
+    if (!network.asn) throw new Error("the network declares no asn");
+
+    const response = await fetch(`${API}/netixlan?asn=${network.asn}`, {
+        headers: { Accept: "application/json" },
+        signal: AbortSignal.timeout(30_000),
+    });
+    if (!response.ok) throw new Error(`PeeringDB answered ${response.status}`);
+
+    const existing = ((await response.json()) as { data: NetIxLan[] }).data;
+    const desired = wanted(network);
+
+    // The record that owns every presence. Taken from an existing one, since the API has no other lookup by ASN here.
+    const netId = existing[0]?.net_id;
+    const changes: PeeringDbChange[] = [];
+
+    for (const record of desired) {
+        const current = existing.find((candidate) => candidate.ixlan_id === record.ixlan_id);
+
+        const body = {
+            net_id: netId,
+            ixlan_id: record.ixlan_id,
+            asn: network.asn,
+            speed: record.speed,
+            ipaddr4: record.ipaddr4,
+            ipaddr6: record.ipaddr6,
+            is_rs_peer: record.is_rs_peer,
+            operational: current?.operational ?? true,
+        };
+
+        if (!current) {
+            changes.push({ summary: `+ ${record.name}: ${record.ipaddr4}, ${record.ipaddr6}, ${record.speed} Mbit/s`, body });
+            continue;
+        }
+
+        const differs =
+            current.ipaddr4 !== record.ipaddr4 ||
+            current.ipaddr6 !== record.ipaddr6 ||
+            current.speed !== record.speed ||
+            current.is_rs_peer !== record.is_rs_peer;
+
+        if (differs) {
+            const before = `${current.ipaddr4}, ${current.ipaddr6}, ${current.speed} Mbit/s, route server ${current.is_rs_peer}`;
+            const after = `${record.ipaddr4}, ${record.ipaddr6}, ${record.speed} Mbit/s, route server ${record.is_rs_peer}`;
+            changes.push({ summary: `~ ${record.name}: ${before} to ${after}`, id: current.id, body });
+        }
+    }
+
+    const unknown = existing
+        .filter((record) => !desired.some((candidate) => candidate.ixlan_id === record.ixlan_id))
+        .map((record) => record.name);
+
+    if (changes.some((change) => !change.id) && !netId) {
+        throw new Error("PeeringDB holds no presence for this network yet, so its record id is unknown; add the first one by hand");
+    }
+
+    return { changes, unknown };
+}
+
+/** Send the changes, with the network's API key. */
+export async function sendPeeringDb(network: Network, changes: PeeringDbChange[]): Promise<void> {
+    if (!network.peeringdb) throw new Error("the network declares no peeringdb api_key");
+    const apiKey = resolve(network.peeringdb.api_key);
+
+    for (const change of changes) {
+        const response = await fetch(`${API}/netixlan${change.id ? `/${change.id}` : ""}`, {
+            method: change.id ? "PUT" : "POST",
+            headers: { Authorization: `Api-Key ${apiKey}`, "Content-Type": "application/json" },
+            body: JSON.stringify(change.body),
+            signal: AbortSignal.timeout(30_000),
+        });
+
+        if (!response.ok) {
+            const reason = (await response.text()).slice(0, 300);
+            throw new Error(`${change.summary}: PeeringDB answered ${response.status} ${reason}`);
+        }
+
+        console.log(`  sent ${change.summary}`);
+    }
+}

package/src/cli/index.ts

@@ -0,0 +1,295 @@
+#!/usr/bin/env bun
+// The command line. Loads `circuit.config.ts` from the working directory.
+
+import { createPrivateKey, createPublicKey } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { adapters } from "../adapters/devices";
+import type { ApplyOptions, DeviceAdapter, Plan } from "../adapters/devices/types";
+import { registries } from "../adapters/registries";
+import { planPeeringDb, sendPeeringDb } from "../adapters/registries/peeringdb";
+import { network as prefixOf } from "../core/addr";
+import type { Network } from "../core/define";
+import { resolve as reveal } from "../core/secrets";
+import { validate } from "../core/validate";
+import type { Device } from "../schema";
+
+const HELP = `usage: circuit <command> [device...] [options]
+
+  validate              check the config, then every rule in checks
+  build <device>        print the configuration the device should run, without contacting it
+  diff [device...]      what apply would send, planned against the last snapshot, offline
+  snapshot [device...]  read what each device runs into the state directory
+  apply <device>        read the device, plan against what it runs, and send with --confirm
+                          --secrets      also send every secret, to rotate one
+                          --rollback=N   minutes before a device that can restore itself does, default 10
+  refresh <device>      fetch prefix sets that come from a registry onto the device, with --confirm
+  wireguard <device> <interface> <peer>
+                        a client config for one peer, its private key left for the peer to fill
+  communities           the network's BGP communities, one per line, for a looking glass or bgp.tools
+  peeringdb             bring PeeringDB's exchange records in line with the config, with --confirm`;
+
+const CONFIG_FILE = "circuit.config.ts";
+
+const root = process.cwd();
+const configPath = resolve(root, CONFIG_FILE);
+
+if (!existsSync(configPath)) {
+    console.error(`no ${CONFIG_FILE} in ${root}`);
+    process.exit(1);
+}
+
+const network = (await import(configPath)).default as Network;
+
+const [command, ...rest] = process.argv.slice(2);
+const flags = rest.filter((arg) => arg.startsWith("--"));
+const names = rest.filter((arg) => !arg.startsWith("--"));
+const confirmed = flags.includes("--confirm");
+const options: ApplyOptions = {
+    secrets: flags.includes("--secrets"),
+    rollback: Number(flags.find((flag) => flag.startsWith("--rollback="))?.split("=")[1] ?? 10),
+};
+
+function fail(message: string): never {
+    console.error(message);
+    process.exit(1);
+}
+
+/** The devices named on the command line, or every device when none is and `allByDefault`. */
+function selected(allByDefault: boolean): Device[] {
+    if (!names.length && allByDefault) return [...network.devices];
+
+    const known = network.devices.map((device) => device.name).join(", ");
+    const byName = (name: string) => network.devices.find((device) => device.name === name);
+
+    return names.map((name) => byName(name) ?? fail(`no device ${name}; known: ${known}`));
+}
+
+function one(): Device {
+    const [device] = selected(false);
+    return device ?? fail("name a device");
+}
+
+const adapterOf = (device: Device): DeviceAdapter => adapters[device.platform] ?? fail(`no adapter for ${device.platform}`);
+const stateDirectory = join(root, network.state);
+const statePath = (device: Device) => join(stateDirectory, device.name + adapterOf(device).extension);
+
+const STATE_README = `# Do not edit
+
+Written by \`circuit snapshot\` and \`circuit apply\`: what each device ran when it was last read, with secrets removed.
+
+An edit here changes nothing on a device and is overwritten on the next read. Change the config instead.
+`;
+
+/** Record what a device runs, beside a note that the directory is generated. */
+function writeState(device: Device, text: string): void {
+    mkdirSync(stateDirectory, { recursive: true });
+    writeFileSync(join(stateDirectory, "README.md"), STATE_README);
+    writeFileSync(statePath(device), text);
+}
+
+/** Validate, print what was found, and stop on an error about one of these devices. */
+function guard(devices: Device[]): void {
+    const relevant = new Set(devices.map((device) => device.name));
+    const findings = validate(network).filter((finding) => !finding.device || relevant.has(finding.device));
+
+    for (const finding of findings) {
+        const where = finding.device ? `${finding.device}: ` : "";
+        const level = finding.level === "error" ? "error" : "warn ";
+        console.log(`  ${level}  ${where}${finding.message}`);
+    }
+
+    const errors = findings.filter((finding) => finding.level === "error").length;
+    if (errors) fail(`\n${errors} error(s).`);
+}
+
+/** Print a plan. Returns how many commands and problems it holds. */
+function show(device: Device, plan: Plan): number {
+    const commands = plan.steps.reduce((count, step) => count + step.send.length, 0);
+    const summary = commands ? `${commands} command(s) in ${plan.steps.length} step(s)` : "matches";
+    console.log(`${device.name}: ${summary}`);
+
+    for (const step of plan.steps) {
+        console.log(`  ${step.title}`);
+        for (const line of step.show) console.log(`    ${line.slice(0, 220)}`);
+    }
+
+    for (const problem of plan.problems) console.log(`  PROBLEM ${problem}`);
+
+    return commands + plan.problems.length;
+}
+
+function validateCommand(): void {
+    guard([...network.devices]);
+    console.log(`${network.devices.length} device(s), no errors.`);
+}
+
+function buildCommand(): void {
+    const device = one();
+    process.stdout.write(adapterOf(device).render(device));
+}
+
+function diffCommand(): void {
+    const devices = selected(true);
+    guard(devices);
+
+    let differences = 0;
+
+    for (const device of devices) {
+        const path = statePath(device);
+        if (!existsSync(path)) {
+            console.log(`${device.name}: no snapshot, run snapshot first`);
+            continue;
+        }
+
+        const adapter = adapterOf(device);
+        const plan = adapter.plan(adapter.render(device), readFileSync(path, "utf8"), options);
+        differences += show(device, plan);
+    }
+
+    process.exit(differences ? 1 : 0);
+}
+
+async function snapshotCommand(): Promise<void> {
+    for (const device of selected(true)) {
+        const text = await adapterOf(device).read(device, network.devices);
+        writeState(device, text);
+        console.log(`${device.name}: ${text.split("\n").length} lines`);
+    }
+}
+
+async function applyCommand(): Promise<void> {
+    const device = one();
+    guard([device]);
+    const adapter = adapterOf(device);
+
+    // The plan is made against what the device runs now, never against an old snapshot.
+    const live = await adapter.read(device, network.devices);
+    writeState(device, live);
+
+    const plan = adapter.plan(adapter.render(device), live, options);
+    if (!show(device, plan)) return;
+
+    if (plan.problems.length) fail("\nNot sent: resolve the problems first.");
+
+    if (!confirmed) {
+        console.log("\nNothing sent. Re-run with --confirm.");
+        return;
+    }
+
+    await adapter.apply(device, network.devices, plan, options);
+
+    writeState(device, await adapter.read(device, network.devices));
+    console.log("snapshot updated");
+}
+
+async function refreshCommand(): Promise<void> {
+    const device = one();
+    const fill = adapterOf(device).fill ?? fail(`${device.platform} cannot hold a fetched prefix set`);
+
+    for (const [name, set] of Object.entries(device.prefix_sets ?? {})) {
+        if (!("source" in set)) continue;
+
+        const { registry, query, family } = set.source;
+        const prefixes = await registries[registry](query, family);
+
+        // An empty or absurd answer is a broken feed, not a policy.
+        if (prefixes.length < 1 || prefixes.length > 100_000) {
+            fail(`${name}: ${prefixes.length} prefixes from ${registry}, refusing`);
+        }
+
+        console.log(`${name}: ${prefixes.length} prefixes from ${registry} ${query}`);
+        if (confirmed) await fill(device, network.devices, name, family, prefixes);
+    }
+
+    if (!confirmed) console.log("\nNothing sent. Re-run with --confirm.");
+}
+
+/** A WireGuard public key from its private key, so the device's never has to be read off the box. */
+function publicKeyOf(privateKey: string): string {
+    // The DER prefix of a raw X25519 private key in PKCS#8.
+    const pkcs8Prefix = Buffer.from("302e020100300506032b656e04220420", "hex");
+    const der = Buffer.concat([pkcs8Prefix, Buffer.from(privateKey, "base64")]);
+
+    const key = createPrivateKey({ key: der, format: "der", type: "pkcs8" });
+    const publicDer = createPublicKey(key).export({ format: "der", type: "spki" });
+
+    return publicDer.subarray(-32).toString("base64");
+}
+
+function wireguardCommand(): void {
+    const [deviceName, interfaceName, peerName] = names;
+    const device = network.devices.find((candidate) => candidate.name === deviceName) ?? fail(HELP);
+
+    const iface = device.interfaces?.[interfaceName ?? ""];
+    if (iface?.type !== "wireguard") fail(`${deviceName} has no WireGuard interface ${interfaceName}`);
+
+    const peers = iface.peers ?? [];
+    const peerNames = peers.map((candidate) => candidate.name).join(", ");
+    const peer = peers.find((candidate) => candidate.name === peerName) ?? fail(`no peer ${peerName} on ${interfaceName}: ${peerNames}`);
+
+    const tunnelNetworks = (iface.addresses ?? []).map((entry) => prefixOf(typeof entry === "string" ? entry : entry.address));
+
+    const lines = [
+        "[Interface]",
+        `# ${peerName}'s own private key. It never leaves their machine.`,
+        "PrivateKey = <FILL IN>",
+        `Address = ${peer.allowed_addresses.join(", ")}`,
+        "",
+        "[Peer]",
+        `PublicKey = ${publicKeyOf(reveal(iface.private_key))}`,
+        `Endpoint = ${iface.endpoint ?? "<FILL IN>"}:${iface.listen_port}`,
+        `AllowedIPs = ${(peer.client_allowed_addresses ?? tunnelNetworks).join(", ")}`,
+        "PersistentKeepalive = 25",
+        "",
+    ];
+    process.stdout.write(lines.join("\n"));
+}
+
+function communitiesCommand(): void {
+    const communities = network.communities ?? fail("the network declares no communities");
+
+    for (const { community, description } of communities) {
+        // The format splits each line at its first comma.
+        if (community.includes(",")) fail(`community ${community} holds a comma`);
+        console.log(`${community},${description}`);
+    }
+}
+
+async function peeringdbCommand(): Promise<void> {
+    const plan = await planPeeringDb(network);
+
+    for (const name of plan.unknown) {
+        console.log(`  PeeringDB lists ${name}, which the config does not. Remove it by hand if the network left.`);
+    }
+
+    for (const change of plan.changes) console.log(`  ${change.summary}`);
+
+    if (!plan.changes.length) {
+        console.log("PeeringDB matches the config.");
+        return;
+    }
+
+    if (!confirmed) {
+        console.log("\nNothing sent. Re-run with --confirm.");
+        return;
+    }
+
+    await sendPeeringDb(network, plan.changes);
+}
+
+const commands: Record<string, () => void | Promise<void>> = {
+    validate: validateCommand,
+    build: buildCommand,
+    diff: diffCommand,
+    snapshot: snapshotCommand,
+    apply: applyCommand,
+    refresh: refreshCommand,
+    wireguard: wireguardCommand,
+    communities: communitiesCommand,
+    peeringdb: peeringdbCommand,
+};
+
+const run = commands[command ?? ""];
+if (run) await run();
+else console.log(HELP);

package/src/core/addr.ts

@@ -0,0 +1,145 @@
+// Address arithmetic for both families. Addresses are parsed to bigint so v4 and v6 share one code path.
+
+import type { Family } from "../schema";
+
+export const familyOf = (address: string): Family => (address.includes(":") ? "ipv6" : "ipv4");
+
+const bitsOf = (family: Family) => (family === "ipv4" ? 32 : 128);
+
+/** An address as a number, or null when it is not one. */
+export function parse(address: string): bigint | null {
+    if (!address.includes(":")) {
+        const octets = address.split(".");
+        const valid = octets.length === 4 && octets.every((octet) => /^\d{1,3}$/.test(octet) && Number(octet) <= 255);
+        if (!valid) return null;
+
+        return octets.reduce((value, octet) => (value << 8n) | BigInt(octet), 0n);
+    }
+
+    const [before, after, extra] = address.split("::");
+    if (extra !== undefined) return null;
+
+    const groupsOf = (text: string | undefined) => (text ? text.split(":") : []);
+    const leading = groupsOf(before);
+    const trailing = groupsOf(after);
+
+    // `::` stands for as many zero groups as make eight.
+    const zeros = after === undefined ? 0 : 8 - leading.length - trailing.length;
+    const groups = [...leading, ...Array(zeros).fill("0"), ...trailing];
+
+    const valid = groups.length === 8 && groups.every((group) => /^[0-9a-fA-F]{1,4}$/.test(group));
+    if (!valid) return null;
+
+    return groups.reduce((value, group) => (value << 16n) | BigInt(parseInt(group, 16)), 0n);
+}
+
+/** `10.0.0.1/24` to its parts. Throws when it is not an address with a length. */
+export function split(cidr: string): { addr: string; len: number; family: Family } {
+    const [address, lengthText] = cidr.split("/");
+    const family = familyOf(address!);
+    const length = Number(lengthText);
+
+    const valid =
+        parse(address!) !== null && lengthText !== undefined && Number.isInteger(length) && length >= 0 && length <= bitsOf(family);
+    if (!valid) throw new Error(`'${cidr}' is not an address with a length`);
+
+    return { addr: address!, len: length, family };
+}
+
+export const isAddress = (text: string) => parse(text) !== null;
+
+export function isCidr(text: string): boolean {
+    try {
+        split(text);
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+const mask = (length: number, family: Family) => {
+    const all = (1n << BigInt(bitsOf(family))) - 1n;
+    const hostBits = (1n << BigInt(bitsOf(family) - length)) - 1n;
+    return all ^ hostBits;
+};
+
+function format(value: bigint, family: Family): string {
+    if (family === "ipv4") {
+        return [24n, 16n, 8n, 0n].map((shift) => String((value >> shift) & 255n)).join(".");
+    }
+
+    const groups = Array.from({ length: 8 }, (_, index) => ((value >> BigInt(112 - index * 16)) & 0xffffn).toString(16));
+
+    // Compress the longest run of zero groups, as RFC 5952 asks.
+    let longestStart = -1;
+    let longestLength = 0;
+
+    for (let start = 0; start < 8;) {
+        let end = start;
+        while (end < 8 && groups[end] === "0") end++;
+
+        const runLength = end - start;
+        if (runLength > longestLength && runLength > 1) {
+            longestStart = start;
+            longestLength = runLength;
+        }
+
+        start = end === start ? start + 1 : end;
+    }
+
+    if (longestStart < 0) return groups.join(":");
+
+    const head = groups.slice(0, longestStart).join(":");
+    const tail = groups.slice(longestStart + longestLength).join(":");
+    return `${head}::${tail}`;
+}
+
+/** `10.0.0.1/24` to `10.0.0.0/24`. */
+export function network(cidr: string): string {
+    const { addr, len, family } = split(cidr);
+    return `${format(parse(addr)! & mask(len, family), family)}/${len}`;
+}
+
+/** Is the address or prefix `inner` inside `outer`? */
+export function contains(outer: string, inner: string): boolean {
+    const outerParts = split(outer);
+    const [innerAddress, innerLengthText] = inner.split("/");
+    if (familyOf(innerAddress!) !== outerParts.family) return false;
+
+    const innerLength = innerLengthText === undefined ? bitsOf(outerParts.family) : Number(innerLengthText);
+    if (innerLength < outerParts.len) return false;
+
+    const outerMask = mask(outerParts.len, outerParts.family);
+    return (parse(innerAddress!)! & outerMask) === (parse(outerParts.addr)! & outerMask);
+}
+
+/** `/25` to `255.255.255.128`. */
+export const netmask = (length: number) => format(mask(length, "ipv4"), "ipv4");
+
+/** `/24` to `0.0.0.255`, the inverted mask some ACLs take. */
+export const wildcard = (length: number) => format(mask(length, "ipv4") ^ 0xffffffffn, "ipv4");
+
+/** The address with its length dropped. */
+export const host = (cidr: string) => cidr.split("/")[0]!;
+
+/** IPv4 space another network cannot reach: this host, private, shared, loopback, link-local and documentation, after RFC 6890. */
+const NOT_GLOBAL_V4 = [
+    "0.0.0.0/8",
+    "10.0.0.0/8",
+    "100.64.0.0/10",
+    "127.0.0.0/8",
+    "169.254.0.0/16",
+    "172.16.0.0/12",
+    "192.0.2.0/24",
+    "192.168.0.0/16",
+    "198.18.0.0/15",
+    "198.51.100.0/24",
+    "203.0.113.0/24",
+];
+
+/** Whether another network can reach the address. IPv6 is global only inside 2000::/3, less documentation space. */
+export function isGlobal(address: string): boolean {
+    if (familyOf(address) === "ipv6") return contains("2000::/3", address) && !contains("2001:db8::/32", address);
+
+    return !NOT_GLOBAL_V4.some((prefix) => contains(prefix, address));
+}