@takodotid/circuit 0.41.0 → 0.42.1

package/src/core/cabling.ts

@@ -121,36 +121,6 @@ export class Cabling {
         return findings;
     }
 
-    /**
-     * Each linked port without a description gets one from its far end: the far device and the far port as printed on it, such as `firewall-1 port6`. The far device's own file has its platform and model, so the label is never written twice. A port whose far device is not in the network keeps none.
-     */
-    static describeLinks(devices: readonly Device[]): Device[] {
-        const byName = new Map(devices.map((device) => [device.name, device]));
-
-        return devices.map((device) => {
-            const ports = Object.entries(device.ports ?? {});
-            if (!ports.some(([, port]) => port?.link && port.description === undefined)) return device;
-
-            const described = ports.map(([name, port]) => {
-                const far = port?.link ? byName.get(port.link.device) : undefined;
-                if (!port?.link || port.description !== undefined || !far) return [name, port];
-
-                return [name, { ...port, description: `${far.name} ${Cabling.labelOf(far, port.link.port)}` }];
-            });
-
-            return { ...device, ports: Object.fromEntries(described) } as Device;
-        });
-    }
-
-    /** A port as printed on the device, or Circuit's name for it when the model has no spelling for it. */
-    private static labelOf(device: Device, port: string): string {
-        try {
-            return Catalog.spell(device.platform, device.model, port);
-        } catch {
-            return port;
-        }
-    }
-
     /** A system name is the device's name, alone or with a domain after it. */
     private static isDevice(system: string, name: string): boolean {
         return system === name || system.startsWith(`${name}.`);

package/src/core/define.ts

@@ -28,6 +28,7 @@ export function defineDevice<
     const Users extends string = never,
     const Vrfs extends string = never,
     const Certificates extends string = never,
+    const Tables extends string = never,
 >(
     device: Device<
         Platform,
@@ -42,7 +43,8 @@ export function defineDevice<
         AddressSets,
         Users,
         Vrfs,
-        Certificates
+        Certificates,
+        Tables
     >
 ): Device {
     return device as unknown as Device;

package/src/core/validator.ts

@@ -63,7 +63,10 @@ export class Validator {
 
             const adapter = Platforms.find(device.platform);
             if (!adapter) report(`no adapter for platform ${device.platform}`);
-            else for (const field of adapter.unsupported(device)) report(`${device.platform} cannot express ${field}`);
+            else {
+                for (const field of adapter.unsupported(device)) report(`${device.platform} cannot express ${field}`);
+                findings.push(...(adapter.checks?.(device) ?? []));
+            }
         }
 
         findings.push(...CrossChecks.run(network.devices));
@@ -291,17 +294,29 @@ export class Validator {
             if (route.bfd && !route.via) report(`static route ${route.prefix} has bfd without via, the address BFD watches`);
             names.expectInterface(`static route ${route.prefix} interface`, route.interface);
             names.expect(`static route ${route.prefix} VRF`, route.vrf, route.vrf !== undefined && route.vrf in (device.vrfs ?? {}));
+            names.expect(
+                `static route ${route.prefix} table`,
+                route.table,
+                route.table !== undefined && route.table in (routing?.tables ?? {})
+            );
+            if (route.vrf && route.table) report(`static route ${route.prefix} has both vrf and table; a route is in one of them`);
         }
 
+        Validator.checkTables(device, names, report, cidr);
+
         const bgp = routing?.bgp;
         const isPolicy = (policy: string | undefined) => policy !== undefined && policy in policies;
 
         for (const prefix of bgp?.networks ?? []) cidr("BGP network", prefix);
 
+        const isTable = (table: string | undefined) => table !== undefined && table in (routing?.tables ?? {});
+
         for (const [name, group] of Object.entries(bgp?.groups ?? {})) {
             for (const policy of [group.import, group.export]) {
                 names.expect(`BGP group ${name} policy`, policy, isPolicy(policy));
             }
+
+            names.expect(`BGP group ${name} table`, group.table, isTable(group.table));
         }
 
         for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
@@ -316,6 +331,8 @@ export class Validator {
                 names.expect(`neighbor ${name} policy`, policy, isPolicy(policy));
             }
 
+            names.expect(`neighbor ${name} table`, neighbor.table, isTable(neighbor.table));
+
             const local = neighbor.local_address ?? group?.local_address;
             if (local && Address.family(local) !== Address.family(neighbor.address))
                 report(`neighbor ${name} local_address and address differ in family`);
@@ -327,6 +344,52 @@ export class Validator {
         }
     }
 
+    /** Routing tables have names of their own and something installing routes in them, and rules name a table and can each be reached. */
+    private static checkTables(device: Device, names: Names, report: Report, cidr: Checker): void {
+        const routing = device.routing;
+        const tables = routing?.tables ?? {};
+        const bgp = routing?.bgp;
+
+        const installed = new Set<string>();
+        for (const route of routing?.static ?? []) if (route.table) installed.add(route.table);
+        for (const neighbor of Object.values(bgp?.neighbors ?? {})) {
+            const table = neighbor.table ?? (neighbor.group ? bgp?.groups?.[neighbor.group]?.table : undefined);
+            if (table) installed.add(table);
+        }
+
+        for (const name of Object.keys(tables)) {
+            if (name === "main") report("routing.tables has main, the main table every device has; give the table another name");
+            if (name in (device.vrfs ?? {})) report(`routing.tables ${name} has the name of a VRF; give the table another name`);
+            if (name !== "main" && !installed.has(name))
+                report(
+                    `routing.tables ${name}: nothing installs routes in it; give a static route or a BGP neighbor table: "${name}", or remove the table`
+                );
+        }
+
+        const rules = routing?.rules ?? [];
+        rules.forEach((rule, index) => {
+            const where = `routing.rules ${index + 1}${rule.description ? ` (${rule.description})` : ""}`;
+            const match = rule.match ?? {};
+
+            names.expect(`${where} table`, rule.table, rule.table === "main" || rule.table in tables);
+            names.expectInterface(`${where} in_interface`, match.in_interface);
+            if (match.src) cidr(where, match.src);
+            if (match.dst) cidr(where, match.dst);
+
+            if (match.src && match.dst && Address.isCidr(match.src) && Address.isCidr(match.dst)) {
+                if (Address.family(Address.host(match.src)) !== Address.family(Address.host(match.dst)))
+                    report(`${where}: src and dst differ in family, so no packet matches both`);
+            }
+
+            if (rule.table === "main" && rule.fallback)
+                report(`${where} looks up main and has fallback; fallback is for another table, so remove it`);
+
+            const matchesAll = !match.src && !match.dst && !match.in_interface;
+            if (matchesAll && index < rules.length - 1)
+                report(`${where} matches every packet, so the rules after it never run; give it a match, or move it last`);
+        });
+    }
+
     private static checkPolicies(device: Device, names: Names, report: Report, cidr: Checker): void {
         const policies = device.policies ?? {};
         const sets = device.prefix_sets ?? {};

package/src/helpers/cables.ts

@@ -1,11 +1,16 @@
-/** The far end of a port, for a description of your own: the device and its port by Circuit's name. */
-export type FarEnd = { device: string; port: string };
+import { Catalog } from "../platforms/catalog";
+
+/** The far end of a port, for a description of your own: the device, its port by Circuit's name, and the port as printed on the device when that end names its platform and model. */
+export type FarEnd = { device: string; port: string; label?: string };
+
+/** One end of a cable entry: the device, and its platform and model if a description should name its ports as printed on it. */
+type End = { device: string; platform?: string; model?: string };
 
 /** What every cable of one entry shares. */
 type Shared = {
     /** What is between the two ends, such as a carrier's local loop. Both ends get it on their `link`. */
     through?: string;
-    /** A port's description from its far end. When absent, Circuit writes the far device and the far port as printed on it, such as `firewall-1 port6`, from the far device's own file. */
+    /** A port's description from its far end, such as `(far) => \`${far.device} ${far.label}\``. No description when absent. */
     describe?: (far: FarEnd) => string;
 };
 
@@ -26,12 +31,10 @@ export class Cables {
      * // router-1: ports: { ...uplink.a }
      * ```
      */
-    static link<const NA extends string, const NB extends string>(
-        spec: Shared & { a: { device: string; port: NA }; b: { device: string; port: NB } }
-    ) {
+    static link<const NA extends string, const NB extends string>(spec: Shared & { a: End & { port: NA }; b: End & { port: NB } }) {
         return {
-            a: { [spec.a.port]: Cables.end(spec, spec.b.device, spec.b.port) } as Record<NA, CablePort<never>>,
-            b: { [spec.b.port]: Cables.end(spec, spec.a.device, spec.a.port) } as Record<NB, CablePort<never>>,
+            a: { [spec.a.port]: Cables.end(spec, spec.b, spec.b.port) } as Record<NA, CablePort<never>>,
+            b: { [spec.b.port]: Cables.end(spec, spec.a, spec.a.port) } as Record<NB, CablePort<never>>,
         };
     }
 
@@ -39,7 +42,7 @@ export class Cables {
      * The cables of a LAG, both ends, from one list read from end A: `{ "25g-1": "10g-2" }` is a cable from A's 25g-1 to B's 10g-2. Each port is a member of its end's LAG. Spread each end into its device's `ports`; the LAG itself stays on each device.
      */
     static lag<const LA extends string, const LB extends string, const C extends Readonly<Record<string, string>>>(
-        spec: Shared & { a: { device: string; lag: LA }; b: { device: string; lag: LB }; cables: C }
+        spec: Shared & { a: End & { lag: LA }; b: End & { lag: LB }; cables: C }
     ) {
         const pairs = Object.entries(spec.cables);
 
@@ -50,8 +53,8 @@ export class Cables {
             taken.set(far, near);
         }
 
-        const a = Object.fromEntries(pairs.map(([near, far]) => [near, { ...Cables.end(spec, spec.b.device, far), lag: spec.a.lag }]));
-        const b = Object.fromEntries(pairs.map(([near, far]) => [far, { ...Cables.end(spec, spec.a.device, near), lag: spec.b.lag }]));
+        const a = Object.fromEntries(pairs.map(([near, far]) => [near, { ...Cables.end(spec, spec.b, far), lag: spec.a.lag }]));
+        const b = Object.fromEntries(pairs.map(([near, far]) => [far, { ...Cables.end(spec, spec.a, near), lag: spec.b.lag }]));
 
         return {
             a: a as Record<keyof C & string, CablePort<LA>>,
@@ -59,11 +62,13 @@ export class Cables {
         };
     }
 
-    /** A port facing `port` on the far device. */
-    private static end(shared: Shared, device: string, port: string): CablePort<never> {
+    /** A port facing `port` on the far end. */
+    private static end(shared: Shared, far: End, port: string): CablePort<never> {
+        const label = far.platform && far.model ? Catalog.spell(far.platform, far.model, port) : undefined;
+
         return {
-            link: { device, port, ...(shared.through ? { through: shared.through } : {}) },
-            ...(shared.describe ? { description: shared.describe({ device, port }) } : {}),
+            link: { device: far.device, port, ...(shared.through ? { through: shared.through } : {}) },
+            ...(shared.describe ? { description: shared.describe({ device: far.device, port, ...(label ? { label } : {}) }) } : {}),
         };
     }
 }

package/src/helpers/exchange.ts

@@ -30,6 +30,10 @@ export type InternetExchange<V extends string> = {
     mac_limit?: number;
     /** The only kinds of frame a member port takes in, usually `ipv4`, `ipv6` and `arp`. Every kind when absent. No platform renders it yet, so `validate` refuses it. */
     ethertypes?: readonly Ethertype[];
+    /** LLDP on member ports. Off when absent: a member's router has no business learning the fabric. */
+    lldp?: boolean;
+    /** Spanning tree on member ports. Off when absent: a member's port faces a router, which must not join the fabric's spanning tree. */
+    stp?: boolean;
 };
 
 /** An internet exchange's fabric: its member ports, a check of its members, and its route servers' config. */
@@ -37,7 +41,9 @@ export class Exchange {
     /**
      * Member ports and a check for an internet exchange's fabric.
      *
-     * - `ports(device)`: every member's port on one switch. A member port is in the peering VLAN and nothing else, takes no part in spanning tree or LLDP, and lets only a trickle of broadcast, multicast and unknown unicast through. With `mac_limit` and `ethertypes`, it also learns that many MAC addresses at most and takes in only those kinds of frame.
+     * - `ports(device)`: every member's port on one switch, each written as
+     *   `{ description: "<name>, AS<asn>", access_vlan: vlan, stp: false, lldp: false, storm_control: { broadcast, multicast, unknown_unicast: { percent: storm_percent } } }`,
+     *   plus `mac_limit` and `ethertypes` when the exchange sets them. `stp` and `lldp` are the exchange's own when it sets them, and storm control is 1 % when `storm_percent` is absent.
      * - `check`: members never share a name, an AS, an address or a port; every address is inside the peering LAN and not reserved; every member port carries the peering VLAN alone.
      * - `bird(server)`: one route server's BIRD 2 config, with a session to every member. Write it to a file for the server; Circuit never logs in to a route server.
      * - `openbgpd(server)`: the same route server's config for OpenBGPD, its `bgpd.conf`, with the same sessions and the same rules.
@@ -55,8 +61,8 @@ export class Exchange {
                 result[port] = {
                     description: `${member.name}, AS${member.asn}`,
                     access_vlan: exchange.vlan,
-                    stp: false,
-                    lldp: false,
+                    stp: exchange.stp ?? false,
+                    lldp: exchange.lldp ?? false,
                     storm_control: { broadcast: { percent }, multicast: { percent }, unknown_unicast: { percent } },
                     ...(exchange.mac_limit !== undefined ? { mac_limit: exchange.mac_limit } : {}),
                     ...(exchange.ethertypes ? { ethertypes: exchange.ethertypes } : {}),

package/src/helpers/upstreams.ts

@@ -63,10 +63,12 @@ export type Upstream = {
     tunnel?: { interface: string; local: IP; remote: IP; addresses: readonly InterfaceAddress[]; mtu?: number };
     /** Our BGP sessions with it, by name: its address, and ours when it is not the interface's. */
     sessions: Readonly<Record<string, { address: IP; local_address?: IP }>>;
-    /** A BGP group its sessions share, by this name: the group holds the AS, role, policies and multihop settings, and each session names it. Each session holds them itself when absent. */
+    /** A BGP group its sessions share, by this name: the group holds the AS, role, policies, table and multihop settings, and each session names it. Each session holds them itself when absent. */
     group?: string;
     /** The sessions are more than one hop away, from this address of ours. */
     multihop?: { local_address: IP; families?: readonly Family[]; password?: Secret };
+    /** The routing table its sessions install the routes they learn in, one of the router's `routing.tables`: a transit that carries only one block's traffic out. The main table when absent. On RouterOS the sessions also announce from that table, so what they announce needs a route there too. */
+    table?: string;
     /** The most prefixes a session may send, by its family: about twice what it sends. Over it, the session closes until it is cleared. */
     limits?: { ipv4?: number; ipv6?: number };
     /** What we take, as its policy. Nothing when absent. */
@@ -105,6 +107,8 @@ type PolicyName<C> = Values<{
 }>;
 /** Each BGP group name. */
 type GroupName<C> = Values<{ [K in keyof C]: C[K] extends { group: infer N extends string } ? N : never }>;
+/** Each routing table name. */
+type TableName<C> = Values<{ [K in keyof C]: C[K] extends { table: infer N extends string } ? N : never }>;
 
 /** A network's upstreams written once, and each device's part built from them. */
 export class Upstreams {
@@ -217,7 +221,7 @@ export class Upstreams {
         const uplinks = () => all.flatMap(([, upstream]) => (upstream.handoff ? [upstream.handoff.interface as HandoffInterface<C>] : []));
 
         /** What a session, or the group it is in, takes from its upstream. */
-        const settings = (key: string, upstream: Upstream): NeighborSettings<PolicyName<C>> => {
+        const settings = (key: string, upstream: Upstream): NeighborSettings<PolicyName<C>, TableName<C>> => {
             const multihop = upstream.multihop;
             return {
                 remote_as: upstream.asn,
@@ -225,6 +229,7 @@ export class Upstreams {
                 role: upstream.role,
                 ...(upstream.import ? { import: upstream.import.name as PolicyName<C> } : {}),
                 export: upstream.export.name as PolicyName<C>,
+                ...(upstream.table ? { table: upstream.table as TableName<C> } : {}),
                 ...(multihop
                     ? {
                           local_address: multihop.local_address,
@@ -239,7 +244,7 @@ export class Upstreams {
         const groups = () =>
             Object.fromEntries(
                 all.flatMap(([key, upstream]) => (upstream.group ? [[upstream.group, settings(key, upstream)]] : []))
-            ) as Record<GroupName<C>, NeighborSettings<PolicyName<C>>>;
+            ) as Record<GroupName<C>, NeighborSettings<PolicyName<C>, TableName<C>>>;
 
         const neighbors = () =>
             Object.fromEntries(
@@ -256,7 +261,7 @@ export class Upstreams {
                         ];
                     })
                 )
-            ) as Record<string, Neighbor<PolicyName<C>, GroupName<C>>>;
+            ) as Record<string, Neighbor<PolicyName<C>, GroupName<C>, TableName<C>>>;
 
         /**
          * Each upstream's import and export, by name. The policies and prefix sets their rules name are checked by `validate`, not by the editor, so the rules are typed to fit any device.

package/src/platforms/bgp-wait.ts

@@ -15,23 +15,23 @@ export class BgpWait {
      */
     static readonly AFTER_APPLY: WaitLimits = { seconds: 180, every: 10 };
 
-    /** Read the sessions until `enough` holds or time runs out, and give the last read. `waiting` is told of each read that fell short, before the pause. */
-    static async until(
-        read: () => Promise<BgpSession[]>,
-        enough: (sessions: BgpSession[]) => boolean,
+    /** Read until `enough` holds or time runs out, and give the last read: the sessions, or what they announce. `waiting` is told of each read that fell short, before the pause. */
+    static async until<T>(
+        read: () => Promise<T>,
+        enough: (value: T) => boolean,
         limits: WaitLimits,
-        waiting: (sessions: BgpSession[]) => void = () => {}
-    ): Promise<BgpSession[]> {
+        waiting: (value: T) => void = () => {}
+    ): Promise<T> {
         const deadline = Date.now() + limits.seconds * 1000;
-        let sessions = await read();
+        let value = await read();
 
-        while (!enough(sessions) && Date.now() < deadline) {
-            waiting(sessions);
+        while (!enough(value) && Date.now() < deadline) {
+            waiting(value);
             await sleep(Math.min(limits.every * 1000, Math.max(0, deadline - Date.now())));
-            sessions = await read();
+            value = await read();
         }
 
-        return sessions;
+        return value;
     }
 
     /** How many of these sessions are established. */

package/src/platforms/derive.ts

@@ -5,7 +5,14 @@ import type { Device } from "../schema";
 
 /** A feature a platform renders once proved on one of its devices. */
 export type ProvedFeature =
-    "bfd-timers" | "static-route-bfd" | "multihop-bfd" | "alarm-severity" | "mac-limit" | "ethertype-filter" | "management-vdom";
+    | "bfd-timers"
+    | "static-route-bfd"
+    | "multihop-bfd"
+    | "alarm-severity"
+    | "mac-limit"
+    | "ethertype-filter"
+    | "management-vdom"
+    | "routing-tables";
 
 export class Derive {
     /** Each LAG's number: its own `id`, or its position among the device's LAGs. */
@@ -47,11 +54,26 @@ export class Derive {
         for (const route of routing?.static ?? []) {
             if (route.bfd && !has("static-route-bfd"))
                 found.push(`routing.static ${route.prefix} bfd, BFD on a static route is ${unproved}`);
+            if (route.table && !has("routing-tables"))
+                found.push(`routing.static ${route.prefix} table, a routing table beside the main one is ${unproved}`);
+        }
+
+        if (!has("routing-tables")) {
+            if (routing?.tables) found.push(`routing.tables, a routing table beside the main one is ${unproved}`);
+            if (routing?.rules) found.push(`routing.rules, routing rules are ${unproved}`);
         }
 
         const bgp = routing?.bgp;
 
+        for (const [name, group] of Object.entries(bgp?.groups ?? {})) {
+            if (group.table && !has("routing-tables"))
+                found.push(`routing.bgp.groups.${name}.table, a routing table beside the main one is ${unproved}`);
+        }
+
         for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
+            if (neighbor.table && !has("routing-tables"))
+                found.push(`routing.bgp.neighbors.${name}.table, a routing table beside the main one is ${unproved}`);
+
             const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
             const bfd = neighbor.bfd ?? group?.bfd;
             const multihop = neighbor.multihop ?? group?.multihop;

package/src/platforms/fortios/routing.ts

@@ -7,7 +7,7 @@ import { FortiOsNames } from "./names";
 import { FortiOsBlock, FortiOsTree } from "./tree";
 
 type AnyRule = PolicyRule<string, string>;
-type AnyNeighbor = Neighbor<string, string>;
+type AnyNeighbor = Neighbor<string, string, string>;
 
 /** The lengths a prefix list's rule takes within its prefix. */
 type Lengths = { ge?: number; le?: number };
@@ -167,7 +167,7 @@ export class FortiOsRouting {
     static readonly BITS = { ipv4: 32, ipv6: 128 } as const;
 
     /** A neighbor's settings with its group's beneath them. */
-    static neighborSettings(device: Device, neighbor: AnyNeighbor): NeighborSettings<string> {
+    static neighborSettings(device: Device, neighbor: AnyNeighbor): NeighborSettings<string, string> {
         const group = neighbor.group ? device.routing?.bgp?.groups?.[neighbor.group] : undefined;
         return { ...group, ...neighbor };
     }

package/src/platforms/junos/bgp.ts

@@ -6,7 +6,7 @@ import type { Device, Family, Neighbor, NeighborSettings, PolicyRule } from "../
 import { JunosRender, type JunosStatements } from "./render";
 
 type AnyRule = PolicyRule<string, string>;
-type AnyNeighbor = Neighbor<string, string>;
+type AnyNeighbor = Neighbor<string, string, string>;
 
 /** BGP sessions, the policies they use, prefix sets and RPKI servers, added to one device's statements. */
 export class JunosBgp {
@@ -41,7 +41,7 @@ export class JunosBgp {
     }
 
     /** A neighbor's settings with its group's beneath them. */
-    static settingsOf(device: Device, neighbor: AnyNeighbor): NeighborSettings<string> {
+    static settingsOf(device: Device, neighbor: AnyNeighbor): NeighborSettings<string, string> {
         const group = neighbor.group ? device.routing?.bgp?.groups?.[neighbor.group] : undefined;
         return { ...group, ...neighbor };
     }

package/src/platforms/platform.ts

@@ -1,4 +1,5 @@
 import type { Neighbor } from "../core/cabling";
+import type { Finding } from "../core/define";
 import type { Device, Family } from "../schema";
 import type { ConsoleDialect } from "../transport/console";
 import type { WaitLimits } from "./bgp-wait";
@@ -100,6 +101,8 @@ export abstract class Platform {
     readonly console: ConsoleDialect | undefined = undefined;
     /** Fields this platform cannot express. Validation fails on any of them, so nothing is skipped silently. */
     abstract unsupported(device: Device): string[];
+    /** What the platform does with a config that it may not do elsewhere, each as `validate` reports it: an error stops `diff` and `apply`, a warning is reported only. Absent on a platform with none. */
+    checks?(device: Device): Finding[];
     /** The switch rules the render makes from the device's hardware ACLs, so `validate` can hold them to the model's limits. Absent on a platform whose rules are not counted. */
     switchRules?(device: Device): SwitchRules;
     /** The whole configuration the device should run. Secrets appear as markers, never values. */

package/src/platforms/routeros/TRAPS.md

@@ -63,3 +63,9 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - `use-bfd=no`, set on a connection that had `use-bfd=yes`, is printed by the export; it is the default, and the plan sets it to take BFD off.
 - No MAC learning limit on 7.23.5: `/interface bridge port` has `learn` but no limit, and `/interface ethernet switch port` has none (CCR2216). `mac_limit` stays refused.
 - A switch rule matches a kind of frame with `mac-protocol` (`ip`, `ipv6`, `arp` among 23 kinds), but cannot match "not" one. An ethertype filter is a rule that lets each kind through and a last one with an empty `new-dst-ports` for the rest, after the port's ACL rules, which match only `ip` or `ipv6`. Four such rules on a free port took the router to 70 switch rules, none invalid (CCR2216, 7.23.5).
+- A routing table holds no routes the router forwards by unless it has `fib`: `/routing table add fib name=...`. The export prints the flag between the properties, `add comment=... fib name=...`.
+- A BGP connection's `routing-table` is where the session installs what it learns and also where it announces from: an `output.network` prefix is announced only while that table has a route for it, and a route in main alone is not enough. On a CCR2216 on 7.23.5, a fresh session with `routing-table=<table>` installed its routes there, active, with the next hop resolved through main, and announced nothing until the table had the prefix too; then it did. Circuit's validate refuses a session in a table that holds none of `networks`, and warns for each it lacks. Routing filters cannot move a route to a table: `set routing-table` and `set table` are `invalid argument`.
+- A running session takes a new `routing-table` only when it restarts, but its announcements stop at once: set from main to a table, it withdrew everything within seconds, kept its learned routes in main, and announced nothing even once the table had the prefix; set back to main, it still announced nothing until it restarted. `/routing bgp session resend afi=ipv6` did not help either, on the router where this was found (#157). Disabling and enabling the connection restarted it in the new table. The plan does exactly that, written on the plan's line, and after an apply Circuit checks that every session still announces what it announced of `networks` before (CCR2216, 7.23.5).
+- A passive connection without `local.address` listens only on its default local address, `local.default-address`, which may be a public one: a peer connecting to another address of the router gets a TCP reset (CCR2216, 7.23.5).
+- `/routing rule` is an ordered list without names, like a filter chain, and the plan rewrites it whole in the config's order. `lookup-only-in-table` drops a packet its table has no route for (a ping printed `no route`); `lookup` routes it by main instead (the ping left). An interface to match is `interface=`. A `drop` or `unreachable` rule is printed with `!realm`, which Circuit does not write (CCR2216, 7.23.5).
+- An eBGP connection to an address on no connected network, without `multihop=yes`, takes the TCP connection, logs `connection <local> from <remote>`, and closes it with no OPEN and nothing else in the log, even with `bgp,debug` logging on (CCR2216, 7.23.5).

package/src/platforms/routeros/export.ts

@@ -137,6 +137,7 @@ export class RouterOsExport {
     /** Menus whose entries are an ordered list without names. They are rewritten whole, in the order the render gives. */
     static readonly ORDERED = new Set([
         "/routing filter rule",
+        "/routing rule",
         "/ip firewall filter",
         "/ipv6 firewall filter",
         "/ip firewall nat",