@takodotid/circuit 0.42.1 → 0.43.1

package/src/core/validator.ts

@@ -1,6 +1,7 @@
 // Rules every network has to satisfy, whatever its design. Types catch most of this at compile time; these run again at load, because config is data and may not come from TypeScript.
 
 import { X509Certificate } from "node:crypto";
+import { Utils } from "./utils";
 import { Platforms } from "../platforms";
 import { Catalog } from "../platforms/catalog";
 import type { Device, Switched } from "../schema";
@@ -297,9 +298,10 @@ export class Validator {
             names.expect(
                 `static route ${route.prefix} table`,
                 route.table,
-                route.table !== undefined && route.table in (routing?.tables ?? {})
+                route.table !== undefined && (route.table === "main" || route.table in (routing?.tables ?? {}))
             );
-            if (route.vrf && route.table) report(`static route ${route.prefix} has both vrf and table; a route is in one of them`);
+            if (route.vrf && Utils.otherTable(route.table))
+                report(`static route ${route.prefix} has both vrf and table; a route is in one of them`);
         }
 
         Validator.checkTables(device, names, report, cidr);
@@ -309,7 +311,7 @@ export class Validator {
 
         for (const prefix of bgp?.networks ?? []) cidr("BGP network", prefix);
 
-        const isTable = (table: string | undefined) => table !== undefined && table in (routing?.tables ?? {});
+        const isTable = (table: string | undefined) => table !== undefined && (table === "main" || table in (routing?.tables ?? {}));
 
         for (const [name, group] of Object.entries(bgp?.groups ?? {})) {
             for (const policy of [group.import, group.export]) {
@@ -351,9 +353,12 @@ export class Validator {
         const bgp = routing?.bgp;
 
         const installed = new Set<string>();
-        for (const route of routing?.static ?? []) if (route.table) installed.add(route.table);
+        for (const route of routing?.static ?? []) {
+            const table = Utils.otherTable(route.table);
+            if (table) installed.add(table);
+        }
         for (const neighbor of Object.values(bgp?.neighbors ?? {})) {
-            const table = neighbor.table ?? (neighbor.group ? bgp?.groups?.[neighbor.group]?.table : undefined);
+            const table = Utils.otherTable(neighbor.table ?? (neighbor.group ? bgp?.groups?.[neighbor.group]?.table : undefined));
             if (table) installed.add(table);
         }
 

package/src/helpers/bgp.ts

@@ -80,13 +80,22 @@ export type CommunityScheme<
     /** A neighbor asks: prepend toward an AS once, twice or three times, `asn:function:asn`. */
     prepend?: { once?: number; twice?: number; three_times?: number };
     /**
-     * A neighbor asks: drop all traffic to this route, `asn:function:0`, usually one address under attack. Your router drops it, and so does every upstream in `upstreams`.
-     *
-     * `upstreams` maps an upstream's AS to its own blackhole community, as its NOC gives it. The route is passed to that upstream with it, so the traffic stops before it reaches your links. An upstream not listed never receives the route.
+     * A neighbor asks: drop all traffic to this route, `asn:function:0`, usually one address under attack. Your router drops it. An upstream whose own blackhole community you know (`communities.blackhole` on the neighbor you pass to `actions`) receives the route with it and drops the traffic too; any other never receives the route.
      */
-    blackhole?: { function: number; upstreams?: Readonly<Record<number, StandardCommunity>> };
+    blackhole?: { function: number };
+};
+
+/** The communities another network offers us, as its NOC gives them: what it does with a route we send it. */
+export type NeighborCommunities = {
+    /** It drops traffic to a route we send it with this community. */
+    blackhole?: StandardCommunity | LargeCommunity;
+    /** It does not pass a route we send it with this community to the AS given, such as an exchange's route servers' `rs-asn:0:peer-asn`. */
+    do_not_announce_to?: (asn: number) => StandardCommunity | LargeCommunity;
 };
 
+/** A neighbor an export goes to: its AS, or its AS and the communities it offers. */
+export type ExportNeighbor = number | { asn: number; communities?: NeighborCommunities };
+
 /** The class names a scheme declares, or any name when it declares none. */
 type ClassName<Classes extends CommunityClasses> = {} extends Classes ? string : Extract<keyof Classes, string>;
 
@@ -248,10 +257,12 @@ export class Bgp {
      * Policy rules and a catalogue from one community scheme, so the communities your routers set, the ones they act on, and the ones you publish never disagree.
      *
      * - `tag(neighborClass, neighborAs, { site, trusted })`: one rule for an import policy, `{ description: "Learned from AS<n>", set }`. Its `set` removes your standard communities and your large ones (a `trusted` neighbor loses only the "where it came from" functions, so it keeps its requests: do not announce, prepend, blackhole), then adds `learned_from`, `learned_at` and `learned_from_as` where the scheme has them. `site` is needed when the scheme has `learned_at`.
-     * - `actions(neighborAs)`: the rules for an export policy toward one neighbor, before the rules that accept. They are `[...blackholeExport(n), ...rejectDoNotAnnounce(n), ...prepends(n), stripOurs()]`; toward a neighbor that takes blackholes (`blackhole.upstreams`), `rejectDoNotAnnounce(n)` comes first, so a route asked not to go there is never passed on as a blackhole.
-     * - `blackholeExport(neighborAs)`: a blackholed route goes no further, `Blackholed here, never announced`, unless `blackhole.upstreams` names the neighbor's own blackhole community: then it is passed on with it, so the neighbor drops the traffic too. Nothing without `blackhole`.
-     * - `rejectDoNotAnnounce(neighborAs)`: rejects a route asked not to be announced anywhere, then one asked not to be announced to this neighbor. Nothing without `do_not_announce`.
-     * - `prepends(neighborAs)`: prepends once, twice or three times toward this neighbor, where a route asks. Nothing without `prepend`.
+     * Each export helper takes the neighbor: its AS, or `{ asn, communities }` with the communities it offers, such as an `Upstreams.catalog` entry.
+     *
+     * - `actions(neighbor)`: the rules for an export policy toward one neighbor, before the rules that accept. They are `[...blackholeExport(n), ...rejectDoNotAnnounce(n), ...prepends(n), stripOurs()]`; toward a neighbor that takes blackholes (`communities.blackhole`), `rejectDoNotAnnounce(n)` comes first, so a route asked not to go there is never passed on as a blackhole.
+     * - `blackholeExport(neighbor)`: a blackholed route goes no further, `Blackholed here, never announced`, unless the neighbor has `communities.blackhole`: then it is passed on with it, so the neighbor drops the traffic too. Nothing without `blackhole` in the scheme.
+     * - `rejectDoNotAnnounce(neighbor)`: rejects a route asked not to be announced anywhere, then one asked not to be announced to this neighbor. Nothing without `do_not_announce`.
+     * - `prepends(neighbor)`: prepends once, twice or three times toward this neighbor, where a route asks. Nothing without `prepend`.
      * - `stripOurs()`: one rule removing every community of yours, `Our communities stay inside our network`.
      * - `blackhole(prefixSets)`: rules for the import policy of a neighbor you trust with blackholes, before anything that rejects long prefixes. They take a route the neighbor asked to blackhole, but only inside `prefixSets`, its own space, and drop traffic to it here. One rule per set, so one call covers both families.
      * - `catalogue`: every community, for `communities` in `defineNetwork`.
@@ -331,28 +342,38 @@ export class Bgp {
             }));
         };
 
+        /** The neighbor's AS. */
+        const asnOf = (neighbor: ExportNeighbor) => (typeof neighbor === "number" ? neighbor : neighbor.asn);
+
         /** The neighbor's own blackhole community, when it takes blackholes from us. */
-        const passOnTo = (neighborAs: number) => scheme.blackhole?.upstreams?.[neighborAs];
+        const passOnTo = (neighbor: ExportNeighbor) => (typeof neighbor === "number" ? undefined : neighbor.communities?.blackhole);
 
-        const blackholeExport = (neighborAs: number): PolicyRule<never, never>[] => {
+        const blackholeExport = (neighbor: ExportNeighbor): PolicyRule<never, never>[] => {
             if (scheme.blackhole === undefined) return [];
 
-            const passOn = passOnTo(neighborAs);
+            const passOn = passOnTo(neighbor);
             const match = { large_community: community(scheme.blackhole.function, 0) };
+            if (!passOn) return [{ description: "Blackholed here, never announced", match, action: "reject" }];
 
-            return passOn
-                ? [
-                      {
-                          description: `Blackhole passed on to AS${neighborAs}`,
-                          match,
-                          set: { remove_communities: ours.standard, remove_large_communities: ours.large, add_communities: [passOn] },
-                          action: "accept",
-                      },
-                  ]
-                : [{ description: "Blackholed here, never announced", match, action: "reject" }];
+            const large = passOn.split(":").length === 3;
+            return [
+                {
+                    description: `Blackhole passed on to AS${asnOf(neighbor)}`,
+                    match,
+                    set: {
+                        remove_communities: ours.standard,
+                        remove_large_communities: ours.large,
+                        ...(large
+                            ? { add_large_communities: [passOn as LargeCommunity] }
+                            : { add_communities: [passOn as StandardCommunity] }),
+                    },
+                    action: "accept",
+                },
+            ];
         };
 
-        const rejectDoNotAnnounce = (neighborAs: number): PolicyRule<never, never>[] => {
+        const rejectDoNotAnnounce = (neighbor: ExportNeighbor): PolicyRule<never, never>[] => {
+            const neighborAs = asnOf(neighbor);
             const fn = scheme.do_not_announce;
             if (fn === undefined) return [];
 
@@ -366,8 +387,9 @@ export class Bgp {
             ];
         };
 
-        const prepends = (neighborAs: number): PolicyRule<never, never>[] =>
+        const prepends = (neighbor: ExportNeighbor): PolicyRule<never, never>[] =>
             Bgp.PREPENDS.flatMap(([name, times]) => {
+                const neighborAs = asnOf(neighbor);
                 const fn = scheme.prepend?.[name];
                 if (fn === undefined) return [];
 
@@ -386,10 +408,10 @@ export class Bgp {
         });
 
         // A route asked not to be announced to a neighbor is never passed on to it as a blackhole either; where nothing is passed on, both only reject.
-        const actions = (neighborAs: number): PolicyRule<never, never>[] =>
-            passOnTo(neighborAs)
-                ? [...rejectDoNotAnnounce(neighborAs), ...blackholeExport(neighborAs), ...prepends(neighborAs), stripOurs()]
-                : [...blackholeExport(neighborAs), ...rejectDoNotAnnounce(neighborAs), ...prepends(neighborAs), stripOurs()];
+        const actions = (neighbor: ExportNeighbor): PolicyRule<never, never>[] =>
+            passOnTo(neighbor)
+                ? [...rejectDoNotAnnounce(neighbor), ...blackholeExport(neighbor), ...prepends(neighbor), stripOurs()]
+                : [...blackholeExport(neighbor), ...rejectDoNotAnnounce(neighbor), ...prepends(neighbor), stripOurs()];
 
         const catalogue: Community[] = [
             ...Object.entries<number>(scheme.learned_from?.classes ?? {}).map(([name, value]) => ({
@@ -424,9 +446,7 @@ export class Bgp {
                 ? [
                       {
                           community: written(scheme.blackhole.function, 0),
-                          description: Object.keys(scheme.blackhole.upstreams ?? {}).length
-                              ? `Blackhole: dropped in AS${asn} and by its upstreams that take it`
-                              : `Blackhole: dropped in AS${asn}, not announced further`,
+                          description: `Blackhole: dropped in AS${asn}, and by the upstreams that take it`,
                       },
                   ]
                 : []),

package/src/helpers/index.ts

@@ -1,7 +1,16 @@
 // Building blocks most networks write the same way: address lists, cables written once for both ends, edge filters, a BGP import sanity policy, an exchange's member ports and route servers, upstreams written once, checks, and helpers for checks of your own. Each returns plain config to place where it belongs, so nothing here applies itself.
 
 export { Bgp } from "./bgp";
-export type { AnnounceOptions, Announced, CommunityScheme, DefaultOnlyOptions, LearnOptions, SanityLengths } from "./bgp";
+export type {
+    AnnounceOptions,
+    Announced,
+    CommunityScheme,
+    DefaultOnlyOptions,
+    ExportNeighbor,
+    LearnOptions,
+    NeighborCommunities,
+    SanityLengths,
+} from "./bgp";
 export { Cables } from "./cables";
 export type { FarEnd } from "./cables";
 export { Checks } from "./checks";

package/src/helpers/upstreams.ts

@@ -5,6 +5,8 @@ import type {
     FilterRule,
     Gre,
     InterfaceAddress,
+    StandardCommunity,
+    LargeCommunity,
     IP,
     Neighbor,
     NeighborSettings,
@@ -15,6 +17,7 @@ import type {
     Vlan,
     VlanInterface,
 } from "../schema";
+import type { NeighborCommunities } from "./bgp";
 
 /** A route policy an upstream's sessions use: its name on the device, and its rules, in order. */
 export type UpstreamPolicy = {
@@ -67,7 +70,7 @@ export type Upstream = {
     group?: string;
     /** The sessions are more than one hop away, from this address of ours. */
     multihop?: { local_address: IP; families?: readonly Family[]; password?: Secret };
-    /** The routing table its sessions install the routes they learn in, one of the router's `routing.tables`: a transit that carries only one block's traffic out. The main table when absent. On RouterOS the sessions also announce from that table, so what they announce needs a route there too. */
+    /** The routing table its sessions install the routes they learn in: `main`, or one of the router's `routing.tables`, for a transit that carries only one block's traffic out. The main table when absent; write `main` to say so. On RouterOS the sessions also announce from that table, so what they announce needs a route there too. */
     table?: string;
     /** The most prefixes a session may send, by its family: about twice what it sends. Over it, the session closes until it is cleared. */
     limits?: { ipv4?: number; ipv6?: number };
@@ -77,6 +80,8 @@ export type Upstream = {
     export: UpstreamPolicy;
     /** Its VLAN is listed by `privateDrops()`, for an ACL that drops RFC 1918 sources arriving from it. Nothing else is done with it. */
     drop_private?: true;
+    /** The communities it offers, as its NOC gives them: its blackhole community, and how to keep a route from one AS. `communityScheme().actions(upstream)` passes blackholes on with it, and `Upstreams.doNotAnnounceTo` uses the other. */
+    communities?: NeighborCommunities;
 };
 
 /** Upstreams by key. */
@@ -107,11 +112,45 @@ type PolicyName<C> = Values<{
 }>;
 /** Each BGP group name. */
 type GroupName<C> = Values<{ [K in keyof C]: C[K] extends { group: infer N extends string } ? N : never }>;
-/** Each routing table name. */
-type TableName<C> = Values<{ [K in keyof C]: C[K] extends { table: infer N extends string } ? N : never }>;
+/** Each routing table name, other than main. */
+type TableName<C> = Exclude<Values<{ [K in keyof C]: C[K] extends { table: infer N extends string } ? N : never }>, "main">;
 
 /** A network's upstreams written once, and each device's part built from them. */
 export class Upstreams {
+    /**
+     * A catalog of upstreams, by key, written once and checked: a key the shape doesn't have is refused by its name. It gives the catalog back as written, so its keys and entries can be read, and is what `define` takes.
+     */
+    static catalog<const C extends UpstreamCatalog>(catalog: C & UpstreamCatalog): C {
+        return catalog;
+    }
+
+    /**
+     * Export rules asking an upstream not to pass our routes to these ASes, with its own `communities.do_not_announce_to`: one rule, `description`, adding one community per AS. Nothing for no AS. An upstream without `do_not_announce_to` is an error, since it can't be asked.
+     */
+    static doNotAnnounceTo(upstream: Upstream, asns: readonly number[], description: string): PolicyRule<never, never>[] {
+        if (!asns.length) return [];
+
+        const community = upstream.communities?.do_not_announce_to;
+        if (!community)
+            throw new Error(
+                `Upstreams: ${upstream.name ?? `AS${upstream.asn}`} has no communities.do_not_announce_to, so it can't be asked to keep our routes from AS${asns.join(", AS")}`
+            );
+
+        const communities = asns.map(community);
+        const large = communities.filter((value) => value.split(":").length === 3) as LargeCommunity[];
+        const standard = communities.filter((value) => value.split(":").length === 2) as StandardCommunity[];
+
+        return [
+            {
+                description,
+                set: {
+                    ...(standard.length ? { add_communities: standard } : {}),
+                    ...(large.length ? { add_large_communities: large } : {}),
+                },
+            },
+        ];
+    }
+
     /**
      * Each upstream written once: its AS, where it lands, its sessions, limits and policies, and every name it puts on a device. Everything a device needs is built from it:
      *
@@ -229,7 +268,7 @@ export class Upstreams {
                 role: upstream.role,
                 ...(upstream.import ? { import: upstream.import.name as PolicyName<C> } : {}),
                 export: upstream.export.name as PolicyName<C>,
-                ...(upstream.table ? { table: upstream.table as TableName<C> } : {}),
+                ...(upstream.table ? { table: upstream.table as TableName<C> | "main" } : {}),
                 ...(multihop
                     ? {
                           local_address: multihop.local_address,

package/src/platforms/derive.ts

@@ -1,6 +1,7 @@
 // Values more than one adapter derives from a device in the same way.
 
 import { Address } from "../core/address";
+import { Utils } from "../core/utils";
 import type { Device } from "../schema";
 
 /** A feature a platform renders once proved on one of its devices. */
@@ -54,7 +55,7 @@ export class Derive {
         for (const route of routing?.static ?? []) {
             if (route.bfd && !has("static-route-bfd"))
                 found.push(`routing.static ${route.prefix} bfd, BFD on a static route is ${unproved}`);
-            if (route.table && !has("routing-tables"))
+            if (Utils.otherTable(route.table) && !has("routing-tables"))
                 found.push(`routing.static ${route.prefix} table, a routing table beside the main one is ${unproved}`);
         }
 
@@ -66,12 +67,12 @@ export class Derive {
         const bgp = routing?.bgp;
 
         for (const [name, group] of Object.entries(bgp?.groups ?? {})) {
-            if (group.table && !has("routing-tables"))
+            if (Utils.otherTable(group.table) && !has("routing-tables"))
                 found.push(`routing.bgp.groups.${name}.table, a routing table beside the main one is ${unproved}`);
         }
 
         for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
-            if (neighbor.table && !has("routing-tables"))
+            if (Utils.otherTable(neighbor.table) && !has("routing-tables"))
                 found.push(`routing.bgp.neighbors.${name}.table, a routing table beside the main one is ${unproved}`);
 
             const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;

package/src/platforms/fortios/plan.ts

@@ -12,13 +12,17 @@ type Table = {
     factory?: readonly string[];
     /** The device keeps the entries in an order of their own, which `move` changes. */
     ordered?: true;
+    /**
+     * The render numbers the entries by their place, but on the device each keeps the number it was created with. An entry is known by what it holds, or else by the settings of the first of `keys` that only it holds, such as its description. A new entry takes a number the device does not use, after `prefix` when the render names entries so.
+     */
+    numbered?: { keys: readonly (readonly string[])[]; prefix?: string };
     /** An entry is known by what it holds, not by its number. */
     byContent?: true;
     /** Settings the device gives an entry it creates. They are unset when the render does not hold them. */
     created?: (entry: FortiOsBlock) => readonly string[];
     /** Settings an entry keeps for life. A change deletes the entry and creates it again. */
     fixed?: readonly string[];
-    /** The device refuses an entry that holds the same as another, `Duplicated entry`, even for a moment while entries are renumbered. */
+    /** Every entry that changes or goes is deleted before any is created. The device refuses a static route the same as another, `Duplicated entry`, even for a moment. */
     distinct?: true;
 };
 
@@ -154,7 +158,13 @@ export class FortiOsPlan {
         "Fortinet_SSL_ED448",
     ];
 
-    private static readonly ORDERED: Table = { ordered: true };
+    /** An entry known by what it holds, or else by its description. */
+    private static readonly BY_COMMENTS: Table["numbered"] = { keys: [["comments"]] };
+
+    private static readonly ORDERED: Table = { ordered: true, numbered: FortiOsPlan.BY_COMMENTS };
+
+    /** A static route known by what it holds, or else by its description. Many routes share a destination, so that is no key. */
+    private static readonly ROUTES: Table = { numbered: { keys: [["comment"]] }, distinct: true };
 
     /** Tables whose entries need more than a plain comparison, by section. */
     private static readonly TABLES: Record<string, Table> = {
@@ -180,8 +190,12 @@ export class FortiOsPlan {
         "firewall local-in-policy": FortiOsPlan.ORDERED,
         "firewall local-in-policy6": FortiOsPlan.ORDERED,
         "firewall central-snat-map": FortiOsPlan.ORDERED,
-        "router static": { distinct: true },
-        "router static6": { distinct: true },
+        "firewall acl": { numbered: FortiOsPlan.BY_COMMENTS },
+        "firewall acl6": { numbered: FortiOsPlan.BY_COMMENTS },
+        // A virtual IP that changes is also known by the address it answers on.
+        "firewall vip": { numbered: { keys: [["comment"], ["extintf", "extip", "protocol", "extport"]], prefix: "dnat-" } },
+        "router static": FortiOsPlan.ROUTES,
+        "router static6": FortiOsPlan.ROUTES,
     };
 
     /** Settings the device keeps for itself: an object's UUID and an interface's SNMP index. */
@@ -399,8 +413,8 @@ export class FortiOsPlan {
 
         const entries = table?.byContent
             ? FortiOsPlan.byContent(path, want, have)
-            : table?.distinct
-              ? FortiOsPlan.distinctById(path, want, have, table, context)
+            : table?.numbered
+              ? FortiOsPlan.numbered(path, want, have, table, table.numbered, context)
               : FortiOsPlan.byId(path, want, have, table, context);
         send.push(...entries.send);
         show.push(...entries.show);
@@ -416,7 +430,7 @@ export class FortiOsPlan {
         return { send, show, removals, removed };
     }
 
-    /** Entries matched by name: new ones created, changed ones edited, gone ones deleted, and an ordered table put in order. */
+    /** Entries matched by name: new ones created, changed ones edited, gone ones deleted. */
     private static byId(path: string[], want: FortiOsBlock, have: FortiOsBlock, table: Table | undefined, context: Context): Diff {
         const send: string[] = [];
         const show: string[] = [];
@@ -456,70 +470,144 @@ export class FortiOsPlan {
             removed.push(...FortiOsPlan.shown("-", [...path, FortiOsTree.bare(entry.id)], entry.block));
         }
 
-        if (table?.ordered) {
-            const moved = FortiOsPlan.moves(want, have);
-            send.push(...moved);
-            show.push(...moved.map((line) => `+ ${FortiOsPlan.labelOf(path)}${line}`));
-        }
-
         return { send, show, removals, removed };
     }
 
-    /** Entries matched by name in a table that refuses two alike: every entry that changes or goes is deleted before any is created, so none is ever briefly the same as another. */
-    private static distinctById(path: string[], want: FortiOsBlock, have: FortiOsBlock, table: Table, context: Context): Diff {
-        const deletes: string[] = [];
-        const creates: string[] = [];
+    /**
+     * Entries the render numbers by their place, while on the device each keeps the number it was created with, so they are matched by what they are.
+     *
+     * An entry that holds the same as one on the device is kept. One that changes is found by the first of the table's keys that no other entry left to match shares, such as its description, and edited under its own number. Any other is new and takes a number the device does not use; in a table the device keeps in order, it is created at the end and moved into place. An entry on the device that nothing matched is deleted last, so every entry the render keeps stays on the device through the whole change.
+     *
+     * In a `distinct` table, an entry that changes is deleted and created again under its own number, and every deletion comes before any creation.
+     */
+    private static numbered(
+        path: string[],
+        want: FortiOsBlock,
+        have: FortiOsBlock,
+        table: Table,
+        numbered: NonNullable<Table["numbered"]>,
+        context: Context
+    ): Diff {
+        const send: string[] = [];
         const show: string[] = [];
 
+        // The number in a name the render gives, such as 7 in `dnat-7`. An entry named otherwise is never kept.
+        const pattern = new RegExp(`^${numbered.prefix ?? ""}(\\d+)$`);
+        const numberOf = (entry: Entry) => Number(pattern.exec(FortiOsTree.bare(entry.id))?.[1] ?? NaN);
+
+        const held = [...have.entries.values()].filter((entry) => !FortiOsPlan.isFactory(table, entry));
+        const kept = new Map<string, Entry>();
+        const unmatched = new Set(held.filter((entry) => Number.isInteger(numberOf(entry))));
+
+        const keep = (key: string, old: Entry) => {
+            kept.set(key, old);
+            unmatched.delete(old);
+        };
+
+        // Only entries with the same signature can hold the same, so an entry is compared with those alone.
+        const alike = Map.groupBy(unmatched, (old) => FortiOsPlan.signature(old.block, context.section));
+        const same = (entry: Entry, old: Entry) => !FortiOsPlan.compare([], entry.block, old.block, undefined, false, context).send.length;
+
         for (const [key, entry] of want.entries) {
-            const old = have.entries.get(key);
-            const where = [...path, FortiOsTree.bare(entry.id)];
+            const candidates = alike.get(FortiOsPlan.signature(entry.block, context.section)) ?? [];
+            const index = candidates.findIndex((old) => same(entry, old));
+            if (index >= 0) keep(key, candidates.splice(index, 1)[0]!);
+        }
+
+        for (const settings of numbered.keys) {
+            const valueOf = (entry: Entry) => {
+                const parts = settings.map((setting) => FortiOsPlan.canonical(setting, entry.block.settings.get(setting) ?? ""));
+                return parts.some(Boolean) ? parts.join("\n") : undefined;
+            };
+
+            const changed = Map.groupBy(
+                [...want.entries].filter(([key]) => !kept.has(key)),
+                ([, entry]) => valueOf(entry)
+            );
+            const left = Map.groupBy(unmatched, valueOf);
+
+            for (const [value, entries] of changed) {
+                const old = left.get(value);
+                if (value !== undefined && entries.length === 1 && old?.length === 1) keep(entries[0]![0], old[0]!);
+            }
+        }
+
+        // A number no entry on the device holds, not even one deleted at the end.
+        let next = Math.max(0, ...[...have.entries.values()].map(numberOf).filter(Number.isInteger)) + 1;
+        const wanted: string[] = [];
+        const replaced: string[] = [];
+
+        for (const [key, entry] of want.entries) {
+            const old = kept.get(key);
+
+            if (!old) {
+                const name = `${numbered.prefix ?? ""}${next++}`;
+                const id = numbered.prefix ? FortiOsTree.quote(name) : name;
+                wanted.push(id);
+                send.push(...FortiOsPlan.creation(entry, table, id));
+                show.push(...FortiOsPlan.shown("+", [...path, name], entry.block));
+                continue;
+            }
+
+            wanted.push(old.id);
 
-            if (old) {
-                if (!FortiOsPlan.compare(where, entry.block, old.block, undefined, false, context).send.length) continue;
+            const where = [...path, FortiOsTree.bare(old.id)];
+            const diff = FortiOsPlan.compare(where, entry.block, old.block, undefined, false, context);
+            if (!diff.send.length) continue;
 
-                deletes.push(`delete ${old.id}`);
-                show.push(...FortiOsPlan.shown("-", where, old.block));
+            if (table.distinct) {
+                replaced.push(`delete ${old.id}`);
+                send.push(...FortiOsPlan.creation(entry, table, old.id));
+                show.push(...FortiOsPlan.shown("-", where, old.block), ...FortiOsPlan.shown("+", where, entry.block));
+                continue;
             }
 
-            creates.push(...FortiOsPlan.creation(entry, table));
-            show.push(...FortiOsPlan.shown("+", where, entry.block));
+            send.push(`edit ${old.id}`, ...diff.send, "next");
+            show.push(...diff.show);
         }
 
-        for (const [key, entry] of have.entries) {
-            if (want.entries.has(key) || FortiOsPlan.isFactory(table, entry)) continue;
+        const keptEntries = new Set(kept.values());
 
-            deletes.push(`delete ${entry.id}`);
-            show.push(...FortiOsPlan.shown("-", [...path, FortiOsTree.bare(entry.id)], entry.block));
+        if (table.ordered) {
+            const order = held.filter((entry) => keptEntries.has(entry)).map((entry) => entry.id);
+            const moved = FortiOsPlan.moves(wanted, order);
+            send.push(...moved);
+            show.push(...moved.map((line) => `+ ${FortiOsPlan.labelOf(path)}${line}`));
         }
 
-        return { send: [...deletes, ...creates], show, removals: [], removed: [] };
-    }
+        const gone = held.filter((entry) => !keptEntries.has(entry));
+        const removals = gone.map((entry) => `delete ${entry.id}`);
+        const removed = gone.flatMap((entry) => FortiOsPlan.shown("-", [...path, FortiOsTree.bare(entry.id)], entry.block));
 
-    /** The `move` commands that put a table's entries in the render's order. Kept entries hold their place on the device and new ones are added at the end. */
-    private static moves(want: FortiOsBlock, have: FortiOsBlock): string[] {
-        const wanted = [...want.entries.keys()];
-        const order = [...have.entries.keys()].filter((key) => want.entries.has(key));
-        order.push(...wanted.filter((key) => !have.entries.has(key)));
+        if (table.distinct) return { send: [...replaced, ...removals, ...send], show: [...removed, ...show], removals: [], removed: [] };
+        return { send, show, removals, removed };
+    }
 
+    /** The `move` commands that put a table's entries in the render's order, by the device's numbers: `wanted` in the render's order, `held` the kept ones in the device's. Kept entries hold their place on the device and new ones are added at the end. */
+    private static moves(wanted: readonly string[], held: readonly string[]): string[] {
+        const order = [...held, ...wanted.filter((id) => !held.includes(id))];
         const send: string[] = [];
-        const idOf = (key: string) => want.entries.get(key)!.id;
 
         for (let index = 0; index < wanted.length; index++) {
-            if (order[index] === wanted[index]) continue;
+            const id = wanted[index]!;
+            if (order[index] === id) continue;
 
-            const key = wanted[index]!;
-            send.push(index === 0 ? `move ${idOf(key)} before ${idOf(order[0]!)}` : `move ${idOf(key)} after ${idOf(wanted[index - 1]!)}`);
-            order.splice(order.indexOf(key), 1);
-            order.splice(index, 0, key);
+            send.push(index === 0 ? `move ${id} before ${order[0]}` : `move ${id} after ${wanted[index - 1]}`);
+            order.splice(order.indexOf(id), 1);
+            order.splice(index, 0, id);
         }
 
         return send;
     }
 
-    /** An entry's settings in the form two entries compare in, whatever their numbers. */
-    private static signature(block: FortiOsBlock): string {
+    /** An entry's settings in the form two entries compare in, whatever their numbers. A setting at its section's default is left out, as the device does not print it. */
+    private static signature(block: FortiOsBlock, section = ""): string {
+        const defaults = FortiOsPlan.DEFAULTS[section] ?? {};
+        const isDefault = (key: string, value: string) =>
+            defaults[key] !== undefined && FortiOsPlan.canonical(key, defaults[key]) === FortiOsPlan.canonical(key, value);
+
         return [...block.settings]
+            .filter(([key, value]) => !isDefault(key, value))
             .map(([key, value]) => `${key} ${FortiOsPlan.canonical(key, value)}`)
             .sort()
             .join("\n");

package/src/platforms/routeros/index.ts

@@ -3,6 +3,7 @@
 // The platform applies every command the moment it arrives and has no candidate configuration, so a run is guarded three ways. Every command is first compiled on the device without running, so a syntax error or an unknown property costs nothing. A backup is saved and a scheduler armed to restore it, and the run must log in again in a fresh session before the scheduler is removed. A command the device refuses restores the backup at once, rather than leaving the device half applied.
 
 import type { Client } from "ssh2";
+import { Utils } from "../../core/utils";
 import { Address } from "../../core/address";
 import type { Neighbor } from "../../core/cabling";
 import type { Finding } from "../../core/define";
@@ -152,21 +153,28 @@ export class RouterOs extends Platform {
 
         for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
             const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
-            const table = neighbor.table ?? group?.table;
+            const table = Utils.otherTable(neighbor.table ?? group?.table);
             if (!table) continue;
 
             const families = neighbor.families ?? group?.families ?? [Address.family(neighbor.address)];
             const networks = (bgp?.networks ?? []).filter((prefix) => families.includes(Address.family(Address.host(prefix))));
             const inTable = (prefix: string) =>
                 statics.some((route) => route.table === table && Address.canonical(route.prefix) === Address.canonical(prefix));
-            const missing = networks.filter((prefix) => !inTable(prefix));
+            // What its export accepts by prefix: a network it would reject anyway needs no route in the table. Every network when the export names none.
+            const exportPolicy = neighbor.export ?? group?.export;
+            const accepted = (exportPolicy ? (device.policies?.[exportPolicy] ?? []) : [])
+                .filter((rule) => rule.action === "accept" && rule.match?.prefix)
+                .map((rule) => Address.canonical(rule.match!.prefix!));
+            const announced = accepted.length ? networks.filter((prefix) => accepted.includes(Address.canonical(prefix))) : networks;
+
+            const missing = announced.filter((prefix) => !inTable(prefix));
             if (!missing.length) continue;
 
             const where = `routing.bgp.neighbors.${name}`;
             const route = (prefix: string) => `{ prefix: "${prefix}", blackhole: true, table: "${table}" }`;
             const fix = `On RouterOS a session announces from its own table, ${table}`;
 
-            if (missing.length === networks.length) {
+            if (missing.length === announced.length) {
                 findings.push({
                     level: "error",
                     device: device.name,