@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/src/checks/across.ts

@@ -0,0 +1,402 @@
+// Rules that span devices: what one device declares about another has to agree with what the other declares. That a link's far end exists and links back
+// is stopped on when the project is read, so a link that doesn't is skipped here.
+
+import { Address } from "../core/address";
+import type { Device, Gre, Prefix, Routed, Switched, Vrrp, Vxlan } from "../model";
+import { Derive } from "../platforms/derive";
+import type { Finding } from "../platforms/finding";
+import { DeviceChecks } from "./device";
+
+/** An address one of the devices holds on a port or interface. */
+export type AddressHolder = {
+    device: Device;
+    /** The port or interface, as a path: `interfaces.ethernet.10g-1`, `interfaces.loopback.lo`. */
+    where: string;
+    /** Whether it is a loopback, which may hold an address another loopback holds, for anycast. */
+    loopback: boolean;
+    /** With its length. */
+    address: string;
+    /** The far end of a point-to-point address. */
+    peer?: string;
+    vrrp: readonly Vrrp[];
+    /** The VRF the address is in. The default table when absent. */
+    vrf?: string;
+};
+
+/** What a port's settings are kept on, as a path: the LAG when the port is in one, otherwise the port. */
+type Carrier = { where: string; settings: Routed & Switched & { mtu?: number } };
+
+/** One end of a GRE or VXLAN tunnel. */
+type TunnelEnd = { device: Device; where: string; kind: "gre" | "vxlan"; tunnel: Gre | Vxlan };
+
+export class CrossChecks {
+    /** Every rule across devices. */
+    static run(devices: readonly Device[]): Finding[] {
+        const holders = CrossChecks.holders(devices);
+
+        // Who holds each address. The first holder wins; a second is reported by `addresses`.
+        const owners = new Map<string, AddressHolder>();
+        for (const holder of holders) {
+            const key = CrossChecks.keyOf(Address.host(holder.address))!;
+            if (!owners.has(key)) owners.set(key, holder);
+        }
+
+        return [
+            ...CrossChecks.links(devices),
+            ...CrossChecks.addresses(holders),
+            ...CrossChecks.sessions(devices, owners),
+            ...CrossChecks.vrrp(holders),
+            ...CrossChecks.tunnels(devices, owners),
+        ];
+    }
+
+    /** An address as a key, so two spellings of one address compare equal. Undefined when it is not an address. */
+    static keyOf(address: string | undefined): string | undefined {
+        if (!address || !Address.isValid(address)) return undefined;
+        return `${Address.family(address)}:${Address.toNumber(address)}`;
+    }
+
+    /** Every valid address the devices hold. An invalid one is left for the device's own checks to report. */
+    static holders(devices: readonly Device[]): AddressHolder[] {
+        return devices.flatMap((device) =>
+            DeviceChecks.holders(device).flatMap(({ where, kind, settings }) =>
+                (settings.addresses ?? []).flatMap((entry) => {
+                    const address = DeviceChecks.addressOf(entry);
+                    if (!Address.isCidr(address)) return [];
+
+                    const peer = typeof entry === "string" ? undefined : entry.peer_address;
+                    return [{ device, where, loopback: kind === "loopback", address, peer, vrrp: settings.vrrp ?? [], vrf: settings.vrf }];
+                })
+            )
+        );
+    }
+
+    /** The VLAN ids a port or LAG carries, by how it carries them, so two ends can be compared across devices. */
+    private static carried(device: Device, settings: Switched) {
+        const id = (vlan: string | undefined) => (vlan ? device.switching?.vlans?.[vlan]?.id : undefined);
+        return {
+            access: id(settings.access_vlan),
+            native: id(settings.native_vlan),
+            trunk: (settings.trunk_vlans ?? []).map(id).sort((a, b) => (a ?? 0) - (b ?? 0)),
+        };
+    }
+
+    /** How a port carries its VLANs, in words: "VLANs 10, 20 tagged and VLAN 30 untagged as native". */
+    private static describeCarried({ access, native, trunk }: ReturnType<typeof CrossChecks.carried>): string {
+        const parts: string[] = [];
+        const tagged = trunk.filter((id) => id !== undefined);
+
+        if (access !== undefined) parts.push(`VLAN ${access} untagged`);
+        if (tagged.length) parts.push(`${tagged.length === 1 ? "VLAN" : "VLANs"} ${tagged.join(", ")} tagged`);
+        if (native !== undefined) parts.push(`VLAN ${native} untagged as native`);
+
+        return parts.length ? parts.join(" and ") : "no VLANs";
+    }
+
+    /** VLAN names by id, for the VLANs a port or LAG carries. */
+    private static vlanNames(device: Device, settings: Switched): Map<number, string> {
+        const names = [settings.access_vlan, settings.native_vlan, ...(settings.trunk_vlans ?? [])].filter((name) => name !== undefined);
+        const vlans = device.switching?.vlans ?? {};
+
+        return new Map(names.flatMap((name) => (vlans[name] ? [[vlans[name].id, name] as const] : [])));
+    }
+
+    /** What a port's settings are kept on: the LAG when the port is in one, otherwise the port. */
+    private static carrierOf(device: Device, portName: string): Carrier {
+        const port = device.interfaces!.ethernet![portName]!;
+        const lag = port.in_lag ? device.interfaces?.lag?.[port.in_lag] : undefined;
+        if (port.in_lag && lag) return { where: `interfaces.lag.${port.in_lag}`, settings: lag };
+
+        return { where: `interfaces.ethernet.${portName}`, settings: port };
+    }
+
+    /** The plain addresses of one family on an interface, leaving out point-to-point ones. */
+    private static plainAddresses(settings: Routed, family: string): string[] {
+        return (settings.addresses ?? []).filter(
+            (entry): entry is Prefix => typeof entry === "string" && Address.isCidr(entry) && Address.family(entry) === family
+        );
+    }
+
+    /** Why the two ends of a cable cannot reach each other by address, or undefined when they can. */
+    private static addressDisagreement(here: Routed, there: Routed, far: Device, farWhere: string): string | undefined {
+        for (const family of ["ipv4", "ipv6"]) {
+            const ours = CrossChecks.plainAddresses(here, family);
+            const theirs = CrossChecks.plainAddresses(there, family);
+            if (!ours.length || !theirs.length) continue;
+
+            // A prefix includes its length, so 10.0.0.0/24 and 10.0.0.0/25 are not one.
+            const theirPrefixes = new Set(theirs.map(Address.prefixOf));
+            if (!ours.some((address) => theirPrefixes.has(Address.prefixOf(address)))) {
+                return `has ${ours.join(", ")}, and ${far.name} ${farWhere} has ${theirs.join(", ")}: not one prefix of one length`;
+            }
+        }
+
+        // A point-to-point address names the far end's own address as its peer.
+        const farHosts = new Set((there.addresses ?? []).map((entry) => CrossChecks.keyOf(Address.host(DeviceChecks.addressOf(entry)))));
+
+        for (const entry of here.addresses ?? []) {
+            if (typeof entry === "string" || !CrossChecks.keyOf(entry.peer_address) || farHosts.has(CrossChecks.keyOf(entry.peer_address)))
+                continue;
+            return `${entry.address} names peer ${entry.peer_address}, which ${far.name} ${farWhere} does not hold`;
+        }
+
+        return undefined;
+    }
+
+    /** Both ends of a link carry the same VLANs the same way, through a LAG on both ends or neither, with the same MTU, speed and addresses. */
+    private static links(devices: readonly Device[]): Finding[] {
+        const findings: Finding[] = [];
+        const byName = new Map(devices.map((device) => [device.name, device]));
+
+        for (const device of devices) {
+            for (const [portName, port] of Derive.ports(device)) {
+                const link = port.link;
+                if (!link) continue;
+
+                // Reading the project stops on a far end that is missing or doesn't link back.
+                const far = byName.get(link.device);
+                const farPort = far?.interfaces?.ethernet?.[link.port];
+                if (!far || !farPort || farPort.link?.device !== device.name || farPort.link.port !== portName) continue;
+
+                const report = (message: string, level: Finding["level"] = "error") =>
+                    findings.push({ level, device: device.name, message: `interfaces.ethernet.${portName}.link: ${message}` });
+
+                const near = CrossChecks.carrierOf(device, portName);
+                const away = CrossChecks.carrierOf(far, link.port);
+                const farPortWhere = `${link.device} interfaces.ethernet.${link.port}`;
+
+                // A LAG's VLANs are on the LAG, so its member ports are compared by what their LAGs carry.
+                const inLag = near.where !== `interfaces.ethernet.${portName}`;
+                const farInLag = away.where !== `interfaces.ethernet.${link.port}`;
+                if (inLag !== farInLag) {
+                    report(
+                        inLag
+                            ? `is in LAG ${port.in_lag}, and ${farPortWhere} is in no LAG`
+                            : `is in no LAG, and ${farPortWhere} is in LAG ${farPort.in_lag}`
+                    );
+                }
+
+                const here = CrossChecks.carried(device, near.settings);
+                const there = CrossChecks.carried(far, away.settings);
+                if (JSON.stringify(here) !== JSON.stringify(there)) {
+                    report(
+                        `${near.where} carries ${CrossChecks.describeCarried(here)}, and ${link.device} ${away.where} carries ${CrossChecks.describeCarried(there)}`
+                    );
+                }
+
+                if (port.speed && farPort.speed && port.speed !== farPort.speed) {
+                    report(`speed ${port.speed}, and ${farPortWhere} is ${farPort.speed}`);
+                }
+
+                const mtu = near.settings.mtu ?? 1500;
+                const farMtu = away.settings.mtu ?? 1500;
+                if (mtu !== farMtu) report(`MTU ${mtu} on ${near.where}, and ${link.device} ${away.where} has ${farMtu}`);
+
+                const disagreement = CrossChecks.addressDisagreement(near.settings, away.settings, far, away.where);
+                if (disagreement) report(`${near.where} ${disagreement}`);
+
+                // One VLAN under two names works, but reads as two VLANs.
+                const farNames = CrossChecks.vlanNames(far, away.settings);
+                for (const [id, name] of CrossChecks.vlanNames(device, near.settings)) {
+                    const farName = farNames.get(id);
+                    if (farName && farName !== name) report(`VLAN ${id} is ${name} here and ${farName} on ${link.device}`, "warning");
+                }
+            }
+        }
+
+        return findings;
+    }
+
+    /** No address is held by two devices in one VRF. Two loopbacks may hold one on purpose, for anycast, so that is a warning. */
+    private static addresses(holders: AddressHolder[]): Finding[] {
+        const findings: Finding[] = [];
+        const first = new Map<string, AddressHolder>();
+
+        for (const holder of holders) {
+            const key = `${holder.vrf ?? ""} ${CrossChecks.keyOf(Address.host(holder.address))!}`;
+            const earlier = first.get(key);
+
+            if (!earlier) {
+                first.set(key, holder);
+                continue;
+            }
+
+            // Two on one device are reported by the device's own checks.
+            if (earlier.device === holder.device) continue;
+
+            const anycast = earlier.loopback && holder.loopback;
+
+            findings.push({
+                level: anycast ? "warning" : "error",
+                device: holder.device.name,
+                message: `${Address.host(holder.address)} on ${holder.where} is also on ${earlier.device.name} ${earlier.where}${anycast ? ", which is right only for anycast" : ""}`,
+            });
+        }
+
+        return findings;
+    }
+
+    /** Each BGP neighbor's address, AS and source, with what it takes from its group. */
+    private static sessionsOf(device: Device) {
+        const bgp = device.routing?.bgp;
+
+        return Object.entries(bgp?.neighbors ?? {}).map(([name, neighbor]) => {
+            const group = neighbor.neighbor_group ? bgp?.neighbor_groups?.[neighbor.neighbor_group] : undefined;
+
+            return {
+                name,
+                address: neighbor.address,
+                remoteAs: neighbor.remote_as ?? group?.remote_as,
+                localAddress: neighbor.local_address ?? group?.local_address,
+            };
+        });
+    }
+
+    /** A BGP session to an address another of our devices holds needs that device's session back, in the AS it expects, from the address it names. */
+    private static sessions(devices: readonly Device[], owners: Map<string, AddressHolder>): Finding[] {
+        const findings: Finding[] = [];
+
+        for (const device of devices) {
+            for (const session of CrossChecks.sessionsOf(device)) {
+                const far = owners.get(CrossChecks.keyOf(session.address) ?? "")?.device;
+                if (!far || far === device) continue;
+
+                const report = (message: string) =>
+                    findings.push({ level: "error", device: device.name, message: `routing.bgp.neighbors.${session.name}: ${message}` });
+
+                const farBgp = far.routing?.bgp;
+                if (!farBgp) {
+                    report(`${session.address} is ${far.name}'s, which runs no BGP`);
+                    continue;
+                }
+
+                if (session.remoteAs !== undefined && session.remoteAs !== farBgp.asn) {
+                    report(`expects AS${session.remoteAs}, and ${far.name} is AS${farBgp.asn}`);
+                }
+
+                // Two routers often hold one session per family, and a session of the other family does not answer this one.
+                const back = CrossChecks.sessionsOf(far).find(
+                    (other) =>
+                        owners.get(CrossChecks.keyOf(other.address) ?? "")?.device === device &&
+                        Address.family(other.address) === Address.family(session.address)
+                );
+                if (!back) {
+                    report(`${far.name} has no session back to ${device.name}`);
+                    continue;
+                }
+
+                // The far end only accepts the session from the address it names.
+                if (session.localAddress && CrossChecks.keyOf(session.localAddress) !== CrossChecks.keyOf(back.address)) {
+                    report(
+                        `starts from ${session.localAddress}, and ${far.name}'s routing.bgp.neighbors.${back.name} expects ${back.address}`
+                    );
+                }
+            }
+        }
+
+        return findings;
+    }
+
+    /** On one segment, a VRRP id has one address and an address has one id, on every device. */
+    private static vrrp(holders: AddressHolder[]): Finding[] {
+        const findings: Finding[] = [];
+        const bySegment = new Map<string, { holder: AddressHolder; id: number; address: string }[]>();
+
+        for (const holder of holders) {
+            const segment = Address.prefixOf(holder.address);
+
+            for (const group of holder.vrrp) {
+                if (!CrossChecks.keyOf(group.address) || Address.family(group.address) !== Address.family(holder.address)) continue;
+                if (!Address.contains(segment, group.address)) continue;
+
+                bySegment.set(segment, [...(bySegment.get(segment) ?? []), { holder, id: group.id, address: group.address }]);
+            }
+        }
+
+        for (const members of bySegment.values()) {
+            for (const member of members) {
+                const where = `${member.holder.device.name} ${member.holder.where}`;
+                const others = members.filter((other) => other.holder.device !== member.holder.device);
+
+                const sameId = others.find(
+                    (other) => other.id === member.id && CrossChecks.keyOf(other.address) !== CrossChecks.keyOf(member.address)
+                );
+                if (sameId) {
+                    findings.push({
+                        level: "error",
+                        device: member.holder.device.name,
+                        message: `VRRP ${member.id} on ${member.holder.where} is ${member.address}, and on ${sameId.holder.device.name} ${sameId.holder.where} it is ${sameId.address}`,
+                    });
+                }
+
+                const sameAddress = others.find(
+                    (other) => CrossChecks.keyOf(other.address) === CrossChecks.keyOf(member.address) && other.id !== member.id
+                );
+                if (sameAddress) {
+                    findings.push({
+                        level: "error",
+                        device: member.holder.device.name,
+                        message: `VRRP address ${member.address} is id ${member.id} on ${where}, and id ${sameAddress.id} on ${sameAddress.holder.device.name} ${sameAddress.holder.where}`,
+                    });
+                }
+            }
+        }
+
+        return findings;
+    }
+
+    /** A GRE or VXLAN tunnel to another of our devices has a tunnel back there, with the endpoints mirrored and, for VXLAN, the same VNI and port. */
+    private static tunnels(devices: readonly Device[], owners: Map<string, AddressHolder>): Finding[] {
+        const findings: Finding[] = [];
+
+        const ends: TunnelEnd[] = devices.flatMap((device) => [
+            ...Object.entries(device.interfaces?.gre ?? {}).flatMap(([name, tunnel]) =>
+                tunnel ? [{ device, where: `interfaces.gre.${name}`, kind: "gre" as const, tunnel }] : []
+            ),
+            ...Object.entries(device.interfaces?.vxlan ?? {}).flatMap(([name, tunnel]) =>
+                tunnel ? [{ device, where: `interfaces.vxlan.${name}`, kind: "vxlan" as const, tunnel }] : []
+            ),
+        ]);
+
+        const same = (a: string, b: string) => CrossChecks.keyOf(a) !== undefined && CrossChecks.keyOf(a) === CrossChecks.keyOf(b);
+        const vniOf = (end: TunnelEnd) => (end.kind === "vxlan" ? (end.tunnel as Vxlan).vni : undefined);
+
+        for (const end of ends) {
+            const far = owners.get(CrossChecks.keyOf(end.tunnel.remote_address) ?? "")?.device;
+            if (!far || far === end.device) continue;
+
+            const report = (message: string) =>
+                findings.push({ level: "error", device: end.device.name, message: `${end.where}: ${message}` });
+            const kind = end.kind === "gre" ? "GRE" : "VXLAN";
+
+            // Two routers may run several VXLAN tunnels between them, one for each VNI, so a tunnel pairs with the one of its own VNI first.
+            const back = ends.filter(
+                (other) =>
+                    other.device === far &&
+                    other.kind === end.kind &&
+                    same(other.tunnel.local_address, end.tunnel.remote_address) &&
+                    same(other.tunnel.remote_address, end.tunnel.local_address)
+            );
+            const mirror = back.find((other) => vniOf(other) === vniOf(end)) ?? back[0];
+
+            if (!mirror) {
+                report(
+                    `${end.tunnel.remote_address} is ${far.name}'s, which has no ${kind} tunnel from there back to ${end.tunnel.local_address}`
+                );
+                continue;
+            }
+
+            if (end.kind !== "vxlan" || mirror.kind !== "vxlan") continue;
+
+            const ours = end.tunnel as Vxlan;
+            const theirs = mirror.tunnel as Vxlan;
+            if (ours.vni !== theirs.vni) report(`VNI ${ours.vni}, and ${far.name} ${mirror.where} has ${theirs.vni}`);
+
+            const port = ours.port ?? 4789;
+            const farPort = theirs.port ?? 4789;
+            if (port !== farPort) report(`UDP port ${port}, and ${far.name} ${mirror.where} has ${farPort}`);
+        }
+
+        return findings;
+    }
+}

package/src/checks/built-in.ts

@@ -0,0 +1,256 @@
+// Circuit's built-in checks, which a network turns on by name in `checks` (`Checks` in src/config/network.ts). `same_vlan_ids` is run when the project is
+// read, so it is not here.
+
+import { Address } from "../core/address";
+import type { Checks } from "../config/network";
+import type { Device, Interface, Switched } from "../model";
+import { Derive } from "../platforms/derive";
+import type { Finding } from "../platforms/finding";
+import { DeviceChecks } from "./device";
+
+/** The built-in checks' settings, as `circuit()` takes them. */
+export type NetworkChecks = Checks<string>;
+
+/** One BGP neighbor's policies, with what it takes from its group. */
+type NeighborPolicies = { name: string; address: string; role?: string; importPolicy?: string; exportPolicy?: string };
+
+/** A route policy rule as the checks read it: a route rule, or a call, which has neither `if` nor `then`. */
+type LooseRule = { if?: { prefix?: string }; then?: string; call?: string };
+
+export class BuiltInChecks {
+    /** Each check the network turns on. A name that is not one of Circuit's is the project's own, which reading the project ran. */
+    static run(devices: readonly Device[], checks: NetworkChecks | undefined): Finding[] {
+        if (!checks) return [];
+
+        return [
+            ...(checks.exports_end_in_reject ? BuiltInChecks.exportsEndInReject(devices) : []),
+            ...(checks.imports_end_in_accept_or_reject ? BuiltInChecks.importsEndInAcceptOrReject(devices) : []),
+            ...(checks.tunnels_outside_offered ? BuiltInChecks.tunnelsOutsideOffered(devices) : []),
+            ...(checks.native_vlans_are_dead_ends ? BuiltInChecks.nativeVlansAreDeadEnds(devices) : []),
+            ...(checks.untrusted_vlans ? BuiltInChecks.untrustedVlans(devices, checks.untrusted_vlans) : []),
+        ];
+    }
+
+    /** Each BGP neighbor of a device, with the role and policies it takes from its group when it sets none. */
+    static neighborPolicies(device: Device): NeighborPolicies[] {
+        const bgp = device.routing?.bgp;
+
+        return Object.entries(bgp?.neighbors ?? {}).map(([name, neighbor]) => {
+            const group = neighbor.neighbor_group ? bgp?.neighbor_groups?.[neighbor.neighbor_group] : undefined;
+
+            return {
+                name,
+                address: neighbor.address,
+                role: neighbor.role ?? group?.role,
+                importPolicy: neighbor.import_policy ?? group?.import_policy,
+                exportPolicy: neighbor.export_policy ?? group?.export_policy,
+            };
+        });
+    }
+
+    /** A policy's rules, read loosely: a call rule is one with neither `if` nor `then`. */
+    private static rulesOf(device: Device, policy: string | undefined): LooseRule[] {
+        return policy ? ((device.routing?.policies?.[policy] ?? []) as readonly LooseRule[]).slice() : [];
+    }
+
+    /** The rule a policy ends in. A policy that ends by calling another, such as the one Circuit makes per AS for a community scheme's requests, ends where the called one ends. */
+    private static lastRuleOf(device: Device, policy: string | undefined, seen = new Set<string>()): LooseRule | undefined {
+        const last = BuiltInChecks.rulesOf(device, policy).at(-1);
+        if (!last?.call || last.if || seen.has(last.call)) return last;
+
+        seen.add(policy!);
+        return BuiltInChecks.lastRuleOf(device, last.call, seen);
+    }
+
+    /** The prefixes an export policy accepts by name. */
+    static offered(device: Device, policy: string | undefined): string[] {
+        return BuiltInChecks.rulesOf(device, policy)
+            .filter((rule) => rule.then === "accept" && rule.if?.prefix)
+            .map((rule) => rule.if!.prefix!);
+    }
+
+    /** The VLANs a port or LAG carries, untagged or tagged. */
+    static vlansOf(port: Pick<Switched, "access_vlan" | "trunk_vlans">): string[] {
+        return [port.access_vlan, ...(port.trunk_vlans ?? [])].filter((vlan): vlan is string => vlan !== undefined);
+    }
+
+    /** `exports_end_in_reject`: every BGP export ends in a reject that matches everything. An export to a neighbor whose `role` is `customer` is left out. */
+    static exportsEndInReject(devices: readonly Device[]): Finding[] {
+        const findings: Finding[] = [];
+
+        for (const device of devices) {
+            for (const neighbor of BuiltInChecks.neighborPolicies(device)) {
+                if (neighbor.role === "customer" || !neighbor.exportPolicy) continue;
+
+                const last = BuiltInChecks.lastRuleOf(device, neighbor.exportPolicy);
+                if (last?.then !== "reject" || last.if) {
+                    findings.push({
+                        level: "error",
+                        device: device.name,
+                        message: `routing.bgp.neighbors.${neighbor.name}: export_policy ${neighbor.exportPolicy} does not end in an unconditional reject`,
+                    });
+                }
+            }
+        }
+
+        return findings;
+    }
+
+    /** `imports_end_in_accept_or_reject`: every BGP import ends in a rule that decides for every route, an accept or a reject without a match. */
+    static importsEndInAcceptOrReject(devices: readonly Device[]): Finding[] {
+        const findings: Finding[] = [];
+
+        for (const device of devices) {
+            for (const neighbor of BuiltInChecks.neighborPolicies(device)) {
+                if (!neighbor.importPolicy) continue;
+
+                const last = BuiltInChecks.lastRuleOf(device, neighbor.importPolicy);
+                if (!last?.then || last.if) {
+                    findings.push({
+                        level: "error",
+                        device: device.name,
+                        message: `routing.bgp.neighbors.${neighbor.name}: import_policy ${neighbor.importPolicy} does not end in an unconditional accept or reject`,
+                    });
+                }
+            }
+        }
+
+        return findings;
+    }
+
+    /** `tunnels_outside_offered`: a GRE or VXLAN tunnel's local address is outside what the neighbors over it are offered, or their replies route back into the tunnel. */
+    static tunnelsOutsideOffered(devices: readonly Device[]): Finding[] {
+        const findings: Finding[] = [];
+
+        for (const device of devices) {
+            const tunnels = Derive.interfaces(device).filter(({ kind }) => kind === "gre" || kind === "vxlan");
+
+            for (const { name, kind, settings } of tunnels) {
+                const local = (settings as Extract<Interface, { local_address: string }>).local_address;
+                const subnets = (settings.addresses ?? []).map(DeviceChecks.addressOf);
+
+                for (const neighbor of BuiltInChecks.neighborPolicies(device)) {
+                    if (!subnets.some((subnet) => Address.contains(subnet, neighbor.address))) continue;
+
+                    for (const prefix of BuiltInChecks.offered(device, neighbor.exportPolicy)) {
+                        if (Address.contains(prefix, local)) {
+                            findings.push({
+                                level: "error",
+                                device: device.name,
+                                message: `interfaces.${kind}.${name} is sourced from ${local}, inside ${prefix}, which routing.bgp.neighbors.${neighbor.name} is offered`,
+                            });
+                        }
+                    }
+                }
+            }
+        }
+
+        return findings;
+    }
+
+    /**
+     * `native_vlans_are_dead_ends`: a native VLAN is native on one trunk (a port or a LAG) of a device at most, and never an access VLAN or a tagged VLAN
+     * anywhere on that device.
+     */
+    static nativeVlansAreDeadEnds(devices: readonly Device[]): Finding[] {
+        const findings: Finding[] = [];
+
+        for (const device of devices) {
+            const carriers = [
+                ...Derive.ports(device).map(([name, port]) => ({ where: `interfaces.ethernet.${name}`, settings: port as Switched })),
+                ...Object.entries(device.interfaces?.lag ?? {}).flatMap(([name, lag]) =>
+                    lag ? [{ where: `interfaces.lag.${name}`, settings: lag as Switched }] : []
+                ),
+            ];
+
+            const nativeOn = new Map<string, string[]>();
+            for (const { where, settings } of carriers) {
+                if (settings.native_vlan) nativeOn.set(settings.native_vlan, [...(nativeOn.get(settings.native_vlan) ?? []), where]);
+            }
+
+            for (const [vlan, trunks] of nativeOn) {
+                const report = (message: string) =>
+                    findings.push({ level: "error", device: device.name, message: `native VLAN ${vlan} ${message}` });
+
+                if (trunks.length > 1) report(`is native on ${trunks.join(", ")}: give each trunk its own`);
+
+                const members = carriers.filter(({ settings }) => BuiltInChecks.vlansOf(settings).includes(vlan));
+                for (const { where } of members) report(`is also an access or tagged VLAN on ${where}`);
+            }
+        }
+
+        return findings;
+    }
+
+    /**
+     * `untrusted_vlans`: traffic from outside reaches your own VLANs only through a filtering device. A port or LAG carrying an untrusted VLAN beside any other
+     * is on a filtering device or faces one, and only a filtering device gives an untrusted VLAN an address. The untrusted VLANs are those written
+     * `untrusted: true` on any device.
+     */
+    static untrustedVlans(devices: readonly Device[], settings: NonNullable<NetworkChecks["untrusted_vlans"]>): Finding[] {
+        const untrusted = new Set(
+            devices.flatMap((device) =>
+                Object.entries(device.switching?.vlans ?? {}).flatMap(([name, vlan]) => (vlan?.untrusted === true ? [name] : []))
+            )
+        );
+        const filtering = new Set<string>(settings.filtering_devices);
+        const mixed = (a: string, b: string) => (settings.mixed_links ?? []).some(([x, y]) => (x === a && y === b) || (x === b && y === a));
+        const findings: Finding[] = [];
+
+        for (const device of devices) {
+            const filters = filtering.has(device.name);
+
+            // What carries VLANs: a port on its own, or a LAG, which faces whatever its members link to.
+            const ports = Derive.ports(device);
+            const carriers = [
+                ...ports
+                    .filter(([, port]) => !port.in_lag)
+                    .map(([name, port]) => ({
+                        where: `interfaces.ethernet.${name}`,
+                        settings: port as Switched,
+                        faces: port.link ? [port.link.device] : [],
+                    })),
+                ...Object.entries(device.interfaces?.lag ?? {}).flatMap(([name, lag]) =>
+                    lag
+                        ? [
+                              {
+                                  where: `interfaces.lag.${name}`,
+                                  settings: lag as Switched,
+                                  faces: ports.filter(([, port]) => port.in_lag === name && port.link).map(([, port]) => port.link!.device),
+                              },
+                          ]
+                        : []
+                ),
+            ];
+
+            for (const { where, settings: carrier, faces } of carriers) {
+                const carried = BuiltInChecks.vlansOf(carrier);
+                const mixes = carried.some((vlan) => untrusted.has(vlan)) && carried.some((vlan) => !untrusted.has(vlan));
+                const facesFilter = filters || faces.some((name) => filtering.has(name));
+                const isMixedLink = faces.length > 0 && faces.every((name) => mixed(device.name, name));
+
+                if (mixes && !facesFilter && !isMixedLink) {
+                    findings.push({
+                        level: "error",
+                        device: device.name,
+                        message: `${where} carries an untrusted VLAN beside a trusted one and does not face one of filtering_devices`,
+                    });
+                }
+            }
+
+            if (filters) continue;
+
+            for (const [name, vlanInterface] of Object.entries(device.interfaces?.vlan_interface ?? {})) {
+                if (vlanInterface && untrusted.has(vlanInterface.vlan)) {
+                    findings.push({
+                        level: "error",
+                        device: device.name,
+                        message: `interfaces.vlan_interface.${name} puts an address on untrusted VLAN ${vlanInterface.vlan}; only one of filtering_devices may`,
+                    });
+                }
+            }
+        }
+
+        return findings;
+    }
+}