@takodotid/circuit 0.41.0 → 0.42.1

package/src/platforms/routeros/index.ts

@@ -5,6 +5,7 @@
 import type { Client } from "ssh2";
 import { Address } from "../../core/address";
 import type { Neighbor } from "../../core/cabling";
+import type { Finding } from "../../core/define";
 import { Secrets } from "../../core/secrets";
 import type { Device, Family } from "../../schema";
 import { SerialConsole, type ConsoleDialect, ConsoleShell } from "../../transport/console";
@@ -84,6 +85,12 @@ export class RouterOs extends Platform {
     ].join(" ");
 
     /** Open again the session from one address, only while it is closed on its limit. */
+    /** Each advertisement of these prefixes, one line each: `ADV|<session>|<prefix>`. One line, because a script sent over exec runs as one. */
+    private static listAdvertisements(prefixes: readonly string[]): string {
+        const where = prefixes.map((prefix) => `dst=${prefix}`).join(" or ");
+        return `:foreach a in=[/routing bgp advertisements print as-value where ${where}] do={ :put ("ADV|" . ($a->"peer") . "|" . ($a->"dst")) }`;
+    }
+
     private static clearLimit(address: string): string {
         return `/routing bgp session clear [find remote.address=${address} and limit-exceeded] flag=limit-exceeded`;
     }
@@ -135,6 +142,51 @@ export class RouterOs extends Platform {
 
     override readonly console = RouterOs.CONSOLE;
 
+    /**
+     * A BGP session with a `table` announces from that table, not from main: each prefix of `networks` it announces needs a route in the table too, or it is not announced (TRAPS.md). A session left with nothing to announce is an error; a prefix missing from its table is a warning, since its export may not announce it anyway.
+     */
+    checks(device: Device): Finding[] {
+        const bgp = device.routing?.bgp;
+        const statics = device.routing?.static ?? [];
+        const findings: Finding[] = [];
+
+        for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
+            const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
+            const table = neighbor.table ?? group?.table;
+            if (!table) continue;
+
+            const families = neighbor.families ?? group?.families ?? [Address.family(neighbor.address)];
+            const networks = (bgp?.networks ?? []).filter((prefix) => families.includes(Address.family(Address.host(prefix))));
+            const inTable = (prefix: string) =>
+                statics.some((route) => route.table === table && Address.canonical(route.prefix) === Address.canonical(prefix));
+            const missing = networks.filter((prefix) => !inTable(prefix));
+            if (!missing.length) continue;
+
+            const where = `routing.bgp.neighbors.${name}`;
+            const route = (prefix: string) => `{ prefix: "${prefix}", blackhole: true, table: "${table}" }`;
+            const fix = `On RouterOS a session announces from its own table, ${table}`;
+
+            if (missing.length === networks.length) {
+                findings.push({
+                    level: "error",
+                    device: device.name,
+                    message: `${where} would announce nothing: ${fix}, which has no route for any of networks. Add the routes it announces to ${table} too, such as ${route(missing[0]!)} in routing.static`,
+                });
+                continue;
+            }
+
+            for (const prefix of missing) {
+                findings.push({
+                    level: "warning",
+                    device: device.name,
+                    message: `${where} does not announce ${prefix}: ${fix}, which has no route for it. If its export should announce it, add ${route(prefix)} to routing.static`,
+                });
+            }
+        }
+
+        return findings;
+    }
+
     unsupported(device: Device): string[] {
         const found: string[] = [];
 
@@ -207,7 +259,16 @@ export class RouterOs extends Platform {
         }
 
         // BFD on a static route and a MAC limit are refused above, for the reason the device gave, and an ethertype filter on a LAG as unproved.
-        found.push(...Derive.unproved(device, ["bfd-timers", "multihop-bfd", "static-route-bfd", "mac-limit", "ethertype-filter"]));
+        found.push(
+            ...Derive.unproved(device, [
+                "bfd-timers",
+                "multihop-bfd",
+                "static-route-bfd",
+                "mac-limit",
+                "ethertype-filter",
+                "routing-tables",
+            ])
+        );
 
         return found;
     }
@@ -418,13 +479,14 @@ export class RouterOs extends Platform {
     }
 
     /**
-     * Two checks after an apply. When the plan touched switch rules, none may be invalid. BGP sessions established before the apply must be established again, within `BgpWait.AFTER_APPLY`.
+     * Three checks after an apply. When the plan touched switch rules, none may be invalid. BGP sessions established before the apply must be established again, and announce again each of the device's `networks` they announced before, within `BgpWait.AFTER_APPLY`. A session can stay up and stop announcing (TRAPS.md), which the session check alone would not see.
      */
     async health(device: Device, plan: Plan, options: HealthOptions = {}): Promise<HealthCheck> {
         const switchRules = plan.steps.some((step) => step.send.some((command) => command.startsWith(RouterOs.SWITCH_RULES)));
         const limits = options.bgp ?? BgpWait.AFTER_APPLY;
 
         const establishedBefore = await this.establishedSessions(device, options);
+        const announcedBefore = establishedBefore.length ? await this.announcedNow(device, options) : [];
 
         return {
             run: async () => {
@@ -438,7 +500,8 @@ export class RouterOs extends Platform {
                 try {
                     const switchProblems = switchRules ? await RouterOs.invalidSwitchRules(session, device) : [];
                     const bgpProblems = await this.bgpBack(device, session, establishedBefore, limits);
-                    return [...switchProblems, ...bgpProblems];
+                    const announceProblems = await this.announcedBack(device, session, announcedBefore, limits);
+                    return [...switchProblems, ...bgpProblems, ...announceProblems];
                 } finally {
                     session.close();
                 }
@@ -549,11 +612,77 @@ export class RouterOs extends Platform {
 
         return down.map((bgp) =>
             bgp.limit
-                ? `BGP session ${bgp.neighbor} was established before the apply and closed on its limit${bgp.limit.max !== undefined ? ` of ${bgp.limit.max} prefixes` : ""}: the neighbor sends more than it may. Find out why, then: circuit bgp ${device.name} ${bgp.neighbor} --clear-limit`
+                ? `BGP session ${bgp.neighbor} was established before the apply and closed on its limit${bgp.limit.max !== undefined ? ` of ${bgp.limit.max} prefixes` : ""}: the neighbor sends more than it may. Find out why, then: circuit bgp ${device.name} --neighbors '^${bgp.neighbor}$' --clear-limit`
                 : `BGP session ${bgp.neighbor} was established before the apply and is not ${limits.seconds} s after it (${bgp.reason ?? (bgp.uptime === "no session" ? "no session" : "not established")}). Look with: circuit bgp ${device.name} --log`
         );
     }
 
+    /** What each session announces of the device's own `networks`, as `neighbor prefix`. None, without logging in, on a device without networks. */
+    private async announcedNow(device: Device, options: ReadOptions): Promise<string[]> {
+        if (!device.routing?.bgp?.networks?.length) return [];
+
+        const session = await this.session(device, options);
+
+        try {
+            return await this.announced(device, session);
+        } finally {
+            session.close();
+        }
+    }
+
+    /** The `networks` each session announces, as `neighbor prefix`, sorted. An advertisement names its session, which is matched to its neighbor by address first, as in `bgpSessions`. */
+    private async announced(device: Device, session: ReadSession): Promise<string[]> {
+        const bgp = device.routing?.bgp;
+        const networks = bgp?.networks ?? [];
+        if (!networks.length) return [];
+
+        const sessions = (await session.run(RouterOs.LIST_BGP_SESSIONS, 60_000))
+            .split(/\r?\n/)
+            .map((line) => line.trim().split("|"))
+            .filter((fields) => fields.length > 1 && fields[0] !== "disabled");
+        const neighbors = Object.entries(bgp?.neighbors ?? {});
+        const neighborOf = (sessionName: string) => {
+            const remote = sessions.find(([name]) => name === sessionName)?.[1];
+            const byAddress = neighbors.find(([, neighbor]) => neighbor.address === remote);
+            const byName = neighbors.find(([name]) => name === sessionName.replace(/-\d+$/, ""));
+            return (byAddress ?? byName)?.[0];
+        };
+
+        const output = await session.run(RouterOs.listAdvertisements(networks), 60_000);
+        return output
+            .split(/\r?\n/)
+            .map((line) => line.trim().split("|"))
+            .flatMap(([marker, peer, prefix]) => {
+                const neighbor = marker === "ADV" && peer ? neighborOf(peer) : undefined;
+                return neighbor && prefix ? [`${neighbor} ${prefix}`] : [];
+            })
+            .sort();
+    }
+
+    /** Wait until each session announces again what it announced before, and give a problem for each prefix a session no longer announces when time runs out. */
+    private async announcedBack(device: Device, session: ReadSession, before: readonly string[], limits: WaitLimits): Promise<string[]> {
+        if (!before.length) return [];
+
+        const missing = (now: string[]) => before.filter((pair) => !now.includes(pair));
+        const after = await BgpWait.until(
+            () => this.announced(device, session),
+            (now) => !missing(now).length,
+            limits,
+            (now) => console.log(`  BGP: ${missing(now).length} announcement(s) not back yet, checking again in ${limits.every} s`)
+        );
+
+        const gone = missing(after);
+        if (!gone.length) {
+            console.log(`  BGP: every session announces what it announced before`);
+            return [];
+        }
+
+        return gone.map((pair) => {
+            const [neighbor, prefix] = pair.split(" ");
+            return `BGP session ${neighbor} announced ${prefix} before the apply and does not ${limits.seconds} s after it, though it may still be established. A RouterOS session announces from its routing table: that table needs a route for ${prefix}, and a session whose table changed must restart. Look with: circuit show ${device.name} '/routing bgp advertisements print'`;
+        });
+    }
+
     /** A problem when any switch rule is invalid, saying what to do. */
     private static async invalidSwitchRules(session: ReadSession, device: Device): Promise<string[]> {
         const answer = (await session.run(RouterOs.COUNT_INVALID_SWITCH_RULES)).trim();

package/src/platforms/routeros/plan.ts

@@ -30,6 +30,9 @@ export class RouterOsPlan {
         "/interface bridge filter",
         "/interface list",
         "/ip vrf",
+        // Routes, rules and BGP connections name a table, so it exists first.
+        "/routing table",
+        "/routing rule",
         "/ip address",
         "/ipv6 address",
         "/ip pool",
@@ -80,6 +83,11 @@ export class RouterOsPlan {
     /** Menus where an entry that keeps its name but changes what it is known by is changed with a `set`, so what points at it by name, such as an address on a VLAN interface, stays attached. In every other menu it is removed and added again. */
     private static readonly CHANGED_IN_PLACE = new Set(["/interface vlan"]);
 
+    /**
+     * Properties a running entry takes only when it restarts. A BGP session given a new `routing-table` stops announcing at once and keeps its routes in the old table until it restarts (TRAPS.md), so the plan disables the connection, changes it and enables it again: one restart, written in the plan.
+     */
+    private static readonly RESTART_ON: Record<string, string[]> = { "/routing bgp connection": ["routing-table"] };
+
     /** The variable holding the old rules of an ordered menu while the new ones are added. Removed when the rewrite ends. */
     private static readonly OLD_RULES = "frameworkOldRules";
 
@@ -311,8 +319,19 @@ export class RouterOsPlan {
             const update = this.changes(entry, current, `${menu} ${entryKey}`);
             if (!Object.keys(update).length) continue;
 
+            const selector = RouterOsPlan.find(menu, RouterOsExport.identity(current));
+            const restartsOn = (RouterOsPlan.RESTART_ON[menu] ?? []).filter((property) => property in update);
+            if (restartsOn.length) {
+                changeStep.show.push(
+                    `~ ${entryKey} ${RouterOsPlan.describe(update)}, restarting the session: it takes a new ${restartsOn.join(" and ")} only when it restarts`
+                );
+                changeStep.send.push(RouterOsPlan.line(menu, "set", selector, [], { disabled: "yes", ...update }));
+                changeStep.send.push(RouterOsPlan.line(menu, "set", selector, [], { disabled: "no" }));
+                continue;
+            }
+
             changeStep.show.push(`~ ${entryKey} ${RouterOsPlan.describe(update)}`);
-            changeStep.send.push(RouterOsPlan.line(menu, "set", RouterOsPlan.find(menu, RouterOsExport.identity(current)), [], update));
+            changeStep.send.push(RouterOsPlan.line(menu, "set", selector, [], update));
         }
 
         const removed = existingEntries.filter((entry) => !kept.has(key(entry)));

package/src/platforms/routeros/render.ts

@@ -32,7 +32,7 @@ export type AnyInterface = Interface<string, string>;
 
 type Speed = NonNullable<AnyPort["speed"]>;
 type AnyRule = PolicyRule<string, string>;
-type AnyNeighbor = Neighbor<string, string>;
+type AnyNeighbor = Neighbor<string, string, string>;
 
 /** One device's render: the device, and the commands collected under their menu. */
 export class RouterOsRender {
@@ -1101,6 +1101,8 @@ export class RouterOsRender {
     }
 
     private routing(): void {
+        this.routingTables();
+        this.routingRules();
         this.staticRoutes();
         this.rpki();
         if (this.device.routing?.bgp) {
@@ -1113,6 +1115,28 @@ export class RouterOsRender {
         this.bfd();
     }
 
+    /** A table beside the main one. `fib` puts its routes in the forwarding table, so traffic can be routed by them. */
+    private routingTables(): void {
+        for (const [name, table] of Object.entries(this.device.routing?.tables ?? {})) {
+            this.add("/routing table", "add fib", { comment: table.description, name });
+        }
+    }
+
+    /** Rules in the order written. `lookup-only-in-table` drops what the table has no route for, and `lookup` falls back to the main table. */
+    private routingRules(): void {
+        for (const rule of this.device.routing?.rules ?? []) {
+            const onlyInTable = rule.table !== "main" && (rule.fallback ?? "none") === "none";
+            this.add("/routing rule", "add", {
+                action: onlyInTable ? "lookup-only-in-table" : "lookup",
+                comment: rule.description,
+                "dst-address": rule.match?.dst,
+                interface: rule.match?.in_interface && this.name(rule.match.in_interface),
+                "src-address": rule.match?.src,
+                table: rule.table,
+            });
+        }
+    }
+
     private staticRoutes(): void {
         for (const route of this.device.routing?.static ?? []) {
             const menu = Address.family(Address.host(route.prefix)) === "ipv4" ? "/ip route" : "/ipv6 route";
@@ -1123,7 +1147,7 @@ export class RouterOsRender {
                 distance: route.distance,
                 "dst-address": route.prefix,
                 gateway,
-                "routing-table": route.vrf,
+                "routing-table": route.vrf ?? route.table,
             });
         }
     }
@@ -1146,7 +1170,7 @@ export class RouterOsRender {
     }
 
     /** A neighbor's settings with its group's beneath them. */
-    private settingsOf(neighbor: AnyNeighbor): NeighborSettings<string> {
+    private settingsOf(neighbor: AnyNeighbor): NeighborSettings<string, string> {
         const group = neighbor.group ? this.device.routing?.bgp?.groups?.[neighbor.group] : undefined;
         return { ...group, ...neighbor };
     }
@@ -1268,6 +1292,7 @@ export class RouterOsRender {
                 "output.network": originates ? RouterOsRender.NETWORKS[family] : undefined,
                 "remote.address": `${neighbor.address}/${addressFamily === "ipv4" ? 32 : 128}`,
                 "remote.as": settings.remote_as,
+                "routing-table": settings.table,
                 "tcp-md5-key": settings.password && Secrets.marker(settings.password),
                 "use-bfd": settings.bfd ? "yes" : undefined,
             });

package/src/schema/device.ts

@@ -71,7 +71,7 @@ export type Vrf = {
 /**
  * Everything one device runs. What is not written here is removed from the device or returned to its default.
  *
- * Type parameters are the names the device declares, so a reference to a name that does not exist fails to compile: N ports, V VLANs, I interfaces, P policies, S prefix sets, G BGP groups, A ACLs, AS address sets, U users, F VRFs, C certificates.
+ * Type parameters are the names the device declares, so a reference to a name that does not exist fails to compile: N ports, V VLANs, I interfaces, P policies, S prefix sets, G BGP groups, A ACLs, AS address sets, U users, F VRFs, C certificates, T routing tables.
  */
 export type Device<
     Pl extends string = string,
@@ -87,6 +87,7 @@ export type Device<
     U extends string = string,
     F extends string = string,
     C extends string = string,
+    T extends string = string,
 > = {
     /** Hostname. */
     name: string;
@@ -112,8 +113,8 @@ export type Device<
     interfaces?: Record<I, Interface<NoInfer<V>, NoInfer<F>>>;
     /** Separate routing tables, keyed by name. */
     vrfs?: Record<F, Vrf>;
-    /** Static routes, BGP, OSPF and route validation. */
-    routing?: Routing<NoInfer<P>, G, NoInfer<I | N>, NoInfer<F>>;
+    /** Routing tables and rules, static routes, BGP, OSPF and route validation. */
+    routing?: Routing<NoInfer<P>, G, NoInfer<I | N>, NoInfer<F>, T>;
     /** Route policies, keyed by name. */
     policies?: Record<P, RoutePolicy<NoInfer<P>, NoInfer<S>>>;
     /** Prefix sets that policies match on, keyed by name. */

package/src/schema/interfaces.ts

@@ -113,7 +113,7 @@ export type Port<V extends string, A extends string, L extends string, F extends
         acl?: A;
         /** The LAG this port is in. Every other setting goes on the LAG. */
         lag?: L;
-        /** Another of our devices at the other end of the cable. Without a `description`, the port is described from it: the far device and the far port as printed on it, such as `firewall-1 port6`. */
+        /** Another of our devices at the other end of the cable. */
         link?: Link;
     };
 

package/src/schema/routing.ts

@@ -1,7 +1,7 @@
 import type { Family, IP, Prefix, Secret } from "./common";
 
 /** A route the device has without learning it. */
-export type StaticRoute<I extends string, F extends string> = {
+export type StaticRoute<I extends string, F extends string, T extends string = never> = {
     /** Destination. */
     prefix: Prefix;
     /** Next-hop address. */
@@ -14,8 +14,10 @@ export type StaticRoute<I extends string, F extends string> = {
     bfd?: true;
     /** Preference against other routes to the same prefix. Lower wins. 1 when absent. */
     distance?: number;
-    /** The VRF the route is in. The default table when absent. */
+    /** The VRF the route is in. The main table when absent. */
     vrf?: F;
+    /** The table the route is in, one of `routing.tables`. The main table when absent. A route has a `vrf` or a `table`, not both. */
+    table?: T;
     /** Why the route exists. */
     description?: string;
 };
@@ -26,7 +28,7 @@ export type StaticRoute<I extends string, F extends string> = {
 export type BgpRole = "provider" | "customer" | "peer" | "rs" | "rs-client";
 
 /** Settings a BGP neighbor can set itself or take from its group. */
-export type NeighborSettings<P extends string> = {
+export type NeighborSettings<P extends string, T extends string = never> = {
     /** The neighbor's AS. Our own AS makes the session internal. */
     remote_as?: number;
     /** Who the neighbor is. */
@@ -55,10 +57,12 @@ export type NeighborSettings<P extends string> = {
     passive?: boolean;
     /** Detect a dead link in under a second with BFD. */
     bfd?: boolean;
+    /** The table the routes learned are installed in, one of `routing.tables`. The main table when absent. On RouterOS the session also announces from that table, so each prefix of `networks` it announces needs a route in the table too, and a running session takes a new table only when it restarts. */
+    table?: T;
 };
 
 /** One BGP session. Settings it does not set come from its group. */
-export type Neighbor<P extends string, G extends string> = NeighborSettings<P> & {
+export type Neighbor<P extends string, G extends string, T extends string = never> = NeighborSettings<P, T> & {
     /** The neighbor's address. */
     address: IP;
     /** The group this neighbor takes a setting from when it does not set that setting itself. */
@@ -66,15 +70,15 @@ export type Neighbor<P extends string, G extends string> = NeighborSettings<P> &
 };
 
 /** BGP on this device. */
-export type Bgp<P extends string, G extends string> = {
+export type Bgp<P extends string, G extends string, T extends string = never> = {
     /** Our AS number. */
     asn: number;
     /** Prefixes this device originates. Each needs a route, for example a static blackhole. Export policy still decides who receives them. */
     networks?: readonly Prefix[];
     /** Settings shared by several neighbors, keyed by group name. */
-    groups?: Record<G, NeighborSettings<P>>;
+    groups?: Record<G, NeighborSettings<P, T>>;
     /** Sessions keyed by name. */
-    neighbors?: Record<string, Neighbor<P, G>>;
+    neighbors?: Record<string, Neighbor<P, G, T>>;
 };
 
 /** How fast BFD notices a dead neighbor: after `multiplier` packets in a row are missed, so in `interval` times `multiplier` milliseconds. */
@@ -120,14 +124,46 @@ export type Ospf<I extends string> = {
     redistribute?: readonly ("connected" | "static")[];
 };
 
+/** A routing table beside the main one. It holds no interfaces: routes go in from static routes and BGP neighbors that name it in `table`, and `routing.rules` send traffic to it. */
+export type RoutingTable = {
+    /** What the table is for. */
+    description?: string;
+};
+
+/** Traffic a routing rule matches: all of what is given. Every packet when absent. */
+export type RoutingRuleMatch<I extends string> = {
+    /** Source prefix. */
+    src?: Prefix;
+    /** Destination prefix. */
+    dst?: Prefix;
+    /** The interface the traffic arrives on. */
+    in_interface?: I;
+};
+
+/** One routing rule: traffic it matches is routed by `table` instead of the main table. */
+export type RoutingRule<I extends string, T extends string> = {
+    /** Why the rule exists. */
+    description?: string;
+    /** What the traffic must match. Every packet when absent, so such a rule is the last one. */
+    match?: RoutingRuleMatch<I>;
+    /** The table that routes the traffic: one of `routing.tables`, or `main`. */
+    table: T | "main";
+    /** When `table` has no route for a packet: `none` drops it as unroutable, `main` routes it by the main table instead. `none` when absent. Not for a rule whose table is `main`. */
+    fallback?: "none" | "main";
+};
+
 /** Routing on this device. */
-export type Routing<P extends string, G extends string, I extends string, F extends string> = {
+export type Routing<P extends string, G extends string, I extends string, F extends string, T extends string = never> = {
     /** Identifies this router to its neighbors. */
     router_id?: IP;
+    /** Routing tables beside the main one, keyed by name. Not `main`, and not the name of a VRF. */
+    tables?: Record<T, RoutingTable>;
+    /** Rules that route matching traffic by another table, such as traffic from one block by its own transits' default. In order: the first that matches decides, and traffic no rule matches is routed by the main table. */
+    rules?: readonly RoutingRule<I, NoInfer<T>>[];
     /** Routes the device has without learning them. */
-    static?: readonly StaticRoute<I, F>[];
+    static?: readonly StaticRoute<I, F, NoInfer<T>>[];
     /** BGP sessions and what they exchange. */
-    bgp?: Bgp<P, G>;
+    bgp?: Bgp<P, G, NoInfer<T>>;
     /** OSPF areas and interfaces. */
     ospf?: Ospf<I>;
     /** Validators answering route origin validation. */

package/templates/colocation/checks.ts

@@ -3,6 +3,7 @@
 import type { Check, Finding } from "@takodotid/circuit";
 import { Address } from "@takodotid/circuit";
 import { Checks } from "@takodotid/circuit/helpers";
+import { blocksOf, type Tenant } from "./tenancy";
 import { TENANTS } from "./tenants";
 
 export default [
@@ -15,21 +16,27 @@ export default [
     // A native VLAN stays on one trunk and nowhere else, or it joins every trunk it is native on.
     Checks.nativeVlansAreDeadEnds,
 
-    // Tenants never share a name, a number, an address or a port. A port given twice would go to the last tenant alone.
+    // Tenants never share a name, a VLAN, an address or a port. A port given twice would go to the last tenant alone.
     () => {
         const findings: Finding[] = [];
         const error = (message: string) => findings.push({ level: "error", message });
+        const vlansOf = (t: Tenant) => [t.internet.vlan, ...(t.private ? [t.private.vlan] : [])];
 
         TENANTS.forEach((t, index) => {
             for (const other of TENANTS.slice(index + 1)) {
                 if (other.name === t.name) error(`tenant ${t.name} is declared twice`);
-                if (other.number === t.number) error(`tenants ${t.name} and ${other.name} share number ${t.number}`);
 
-                for (const block of t.blocks) {
-                    const clash = other.blocks.find(
-                        ({ prefix }) => Address.contains(prefix, block.prefix) || Address.contains(block.prefix, prefix)
-                    );
-                    if (clash) error(`${block.prefix} of ${t.name} overlaps ${clash.prefix} of ${other.name}`);
+                for (const vlan of vlansOf(t)) {
+                    for (const theirs of vlansOf(other)) {
+                        if (theirs.id === vlan.id)
+                            error(`VLAN ${vlan.id} is both ${vlan.name} of ${t.name} and ${theirs.name} of ${other.name}`);
+                        if (theirs.name === vlan.name) error(`VLAN ${vlan.name} is declared by both ${t.name} and ${other.name}`);
+                    }
+                }
+
+                for (const block of blocksOf(t)) {
+                    const clash = blocksOf(other).find((prefix) => Address.contains(prefix, block) || Address.contains(block, prefix));
+                    if (clash) error(`${block} of ${t.name} overlaps ${clash} of ${other.name}`);
                 }
             }
 
@@ -39,10 +46,6 @@ export default [
                     if (sharer) error(`port ${port} on ${device} is given to both ${t.name} and ${sharer.name}`);
                 }
             }
-
-            for (const { prefix, gateway } of t.blocks) {
-                if (!Address.contains(prefix, gateway)) error(`the gateway ${gateway} of ${t.name} is outside ${prefix}`);
-            }
         });
 
         return findings;

package/templates/colocation/edge-01.ts

@@ -6,7 +6,7 @@ import type { Prefix } from "@takodotid/circuit";
 import { defineDevice, secret, Utils } from "@takodotid/circuit";
 import { Bgp, Filters } from "@takodotid/circuit/helpers";
 import { ASN, communities } from "./routing";
-import { edgeRules, gateways, internetVlanNames, internetVlans } from "./tenancy";
+import { edgeRules, gateways, internetVlanNames, routerVlans } from "./tenancy";
 import { TENANTS } from "./tenants";
 
 /** The address space this router announces. */
@@ -34,7 +34,7 @@ export default defineDevice({
             transit: { id: 300, description: "IP transit from Hurricane Electric, AS6939" },
             ix: { id: 200, description: "Peering LAN of SGIX" },
         },
-        internetVlans(TENANTS)
+        routerVlans(TENANTS)
     ),
 
     ports: {