@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/dist/helpers/index.js

@@ -1,881 +0,0 @@
-import {
-  Catalog
-} from "../chunks/index-6wb41q67.js";
-import {
-  Address2
-} from "../chunks/index-n7w3tg5y.js";
-
-// src/helpers/bgp.ts
-class Bgp {
-  static PREPENDS = [
-    ["once", 1],
-    ["twice", 2],
-    ["three_times", 3]
-  ];
-  static DEFAULTS = [
-    { family: "ipv4", prefix: "0.0.0.0/0" },
-    { family: "ipv6", prefix: "::/0" }
-  ];
-  static sanity(lengths = {}) {
-    const ipv4 = lengths.ipv4 ?? { min: 8, max: 24 };
-    const ipv6 = lengths.ipv6 ?? { min: 16, max: 48 };
-    return [
-      {
-        description: `IPv4 shorter than /${ipv4.min}`,
-        match: { family: "ipv4", prefix_length: { max: ipv4.min - 1 } },
-        action: "reject"
-      },
-      {
-        description: `IPv4 longer than /${ipv4.max}`,
-        match: { family: "ipv4", prefix_length: { min: ipv4.max + 1 } },
-        action: "reject"
-      },
-      {
-        description: `IPv6 shorter than /${ipv6.min}`,
-        match: { family: "ipv6", prefix_length: { max: ipv6.min - 1 } },
-        action: "reject"
-      },
-      {
-        description: `IPv6 longer than /${ipv6.max}`,
-        match: { family: "ipv6", prefix_length: { min: ipv6.max + 1 } },
-        action: "reject"
-      },
-      { description: "RPKI invalid", match: { rpki: "invalid" }, action: "reject" }
-    ];
-  }
-  static announce(prefixes, options = {}) {
-    return [
-      ...prefixes.map(({ prefix, description }) => ({
-        ...description ? { description } : {},
-        match: { prefix },
-        action: "accept"
-      })),
-      ...options.reject === false ? [] : [Bgp.NOTHING_ELSE]
-    ];
-  }
-  static NOTHING_ELSE = { description: "Nothing else", action: "reject" };
-  static learn(options = {}) {
-    const { tag } = options;
-    return [
-      ...options.before ?? [],
-      ...options.sanity ? [{ call: options.sanity }] : Bgp.sanity(),
-      ...(options.sources ?? []).map((source) => ({ set: { preferred_source: source } })),
-      ...options.local_pref !== undefined ? [{ set: { local_pref: options.local_pref } }] : [],
-      ...tag === undefined ? [] : ["standard" in tag ? Bgp.adding(tag.standard) : ("large" in tag) ? Bgp.adding(tag.large) : tag],
-      { action: "accept" }
-    ];
-  }
-  static defaultOnly(options = {}) {
-    const defaults = Bgp.DEFAULTS.map(({ family, prefix }) => {
-      const source = options.sources?.find((address) => Address2.family(address) === family);
-      const set = {
-        ...options.local_pref !== undefined ? { local_pref: options.local_pref } : {},
-        ...source ? { preferred_source: source } : {}
-      };
-      return {
-        description: options.description ?? `Default route, ${family}`,
-        match: { prefix },
-        ...Object.keys(set).length ? { set } : {},
-        action: "accept"
-      };
-    });
-    return options.reject ? [...defaults, Bgp.NOTHING_ELSE] : defaults;
-  }
-  static adding(community) {
-    const large = community.split(":").length === 3;
-    return {
-      description: `Tag ${community}`,
-      set: large ? { add_large_communities: [community] } : { add_communities: [community] }
-    };
-  }
-  static neighborPolicies(device) {
-    const bgp = device.routing?.bgp;
-    return Object.entries(bgp?.neighbors ?? {}).map(([name, neighbor]) => {
-      const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
-      return {
-        name,
-        address: neighbor.address,
-        role: neighbor.role ?? group?.role,
-        import: neighbor.import ?? group?.import,
-        export: neighbor.export ?? group?.export
-      };
-    });
-  }
-  static offered(device, policy) {
-    const rules = policy ? device.policies?.[policy] ?? [] : [];
-    return rules.filter((rule) => rule.action === "accept" && rule.match?.prefix).map((rule) => rule.match.prefix);
-  }
-  static communityScheme(scheme) {
-    const { asn } = scheme;
-    const community = (fn, parameter) => `${asn}:${fn}:${parameter}`;
-    const anyOf = (fn) => `${asn}:${fn}:*`;
-    const written = (fn, parameter) => `${asn}:${fn}:${parameter}`;
-    const ours = {
-      standard: [`${asn}:*`],
-      large: [`${asn}:*:*`]
-    };
-    const learnedFrom = Object.fromEntries(Object.entries(scheme.learned_from?.classes ?? {}).map(([name, value]) => [
-      name,
-      community(scheme.learned_from.function, value)
-    ]));
-    const information = [scheme.learned_from?.function, scheme.learned_at?.function, scheme.learned_from_as].filter((fn) => fn !== undefined);
-    const tag = (neighborClass, neighborAs, options = {}) => {
-      const { site, trusted = false } = options;
-      if (scheme.learned_at && site === undefined)
-        throw new Error(`Bgp.communityScheme: tag for AS${neighborAs} needs a site, for learned_at`);
-      return {
-        description: `Learned from AS${neighborAs}`,
-        set: {
-          remove_communities: ours.standard,
-          remove_large_communities: trusted ? information.map(anyOf) : ours.large,
-          add_large_communities: [
-            ...scheme.learned_from ? [community(scheme.learned_from.function, scheme.learned_from.classes[neighborClass])] : [],
-            ...scheme.learned_at ? [community(scheme.learned_at.function, site)] : [],
-            ...scheme.learned_from_as !== undefined ? [community(scheme.learned_from_as, neighborAs)] : []
-          ]
-        }
-      };
-    };
-    const blackhole = (prefixSets) => {
-      const fn = scheme.blackhole?.function;
-      if (fn === undefined)
-        throw new Error("Bgp.communityScheme: blackhole needs a function number in the scheme");
-      return prefixSets.map((prefixSet) => ({
-        description: "Blackhole, asked by the neighbor",
-        match: { large_community: community(fn, 0), prefix_set: prefixSet },
-        set: { blackhole: true },
-        action: "accept"
-      }));
-    };
-    const asnOf = (neighbor) => typeof neighbor === "number" ? neighbor : neighbor.asn;
-    const passOnTo = (neighbor) => typeof neighbor === "number" ? undefined : neighbor.communities?.blackhole;
-    const blackholeExport = (neighbor) => {
-      if (scheme.blackhole === undefined)
-        return [];
-      const passOn = passOnTo(neighbor);
-      const match = { large_community: community(scheme.blackhole.function, 0) };
-      if (!passOn)
-        return [{ description: "Blackholed here, never announced", match, action: "reject" }];
-      const large = passOn.split(":").length === 3;
-      return [
-        {
-          description: `Blackhole passed on to AS${asnOf(neighbor)}`,
-          match,
-          set: {
-            remove_communities: ours.standard,
-            remove_large_communities: ours.large,
-            ...large ? { add_large_communities: [passOn] } : { add_communities: [passOn] }
-          },
-          action: "accept"
-        }
-      ];
-    };
-    const rejectDoNotAnnounce = (neighbor) => {
-      const neighborAs = asnOf(neighbor);
-      const fn = scheme.do_not_announce;
-      if (fn === undefined)
-        return [];
-      return [
-        { description: "Asked not to be announced anywhere", match: { large_community: community(fn, 0) }, action: "reject" },
-        {
-          description: `Asked not to be announced to AS${neighborAs}`,
-          match: { large_community: community(fn, neighborAs) },
-          action: "reject"
-        }
-      ];
-    };
-    const prepends = (neighbor) => Bgp.PREPENDS.flatMap(([name, times]) => {
-      const neighborAs = asnOf(neighbor);
-      const fn = scheme.prepend?.[name];
-      if (fn === undefined)
-        return [];
-      return [
-        {
-          description: `Asked to prepend ${name.replace("_", " ")} to AS${neighborAs}`,
-          match: { large_community: community(fn, neighborAs) },
-          set: { prepend: times }
-        }
-      ];
-    });
-    const stripOurs = () => ({
-      description: "Our communities stay inside our network",
-      set: { remove_communities: ours.standard, remove_large_communities: ours.large }
-    });
-    const actions = (neighbor) => passOnTo(neighbor) ? [...rejectDoNotAnnounce(neighbor), ...blackholeExport(neighbor), ...prepends(neighbor), stripOurs()] : [...blackholeExport(neighbor), ...rejectDoNotAnnounce(neighbor), ...prepends(neighbor), stripOurs()];
-    const catalogue = [
-      ...Object.entries(scheme.learned_from?.classes ?? {}).map(([name, value]) => ({
-        community: written(scheme.learned_from.function, value),
-        description: `Learned from ${Bgp.article(name)}`
-      })),
-      ...scheme.learned_at ? [
-        ...Object.entries(scheme.learned_at.sites ?? {}).map(([site, name]) => ({
-          community: written(scheme.learned_at.function, site),
-          description: `Learned in ${name}`
-        })),
-        { community: written(scheme.learned_at.function, "nnn"), description: "Learned at site $0" }
-      ] : [],
-      ...scheme.learned_from_as !== undefined ? [{ community: written(scheme.learned_from_as, "nnn"), description: "Learned from AS$0" }] : [],
-      ...scheme.do_not_announce !== undefined ? [
-        { community: written(scheme.do_not_announce, 0), description: "Do not announce to anyone" },
-        { community: written(scheme.do_not_announce, "nnn"), description: "Do not announce to AS$0" }
-      ] : [],
-      ...Bgp.PREPENDS.flatMap(([name]) => {
-        const fn = scheme.prepend?.[name];
-        return fn === undefined ? [] : [{ community: written(fn, "nnn"), description: `Prepend ${name.replace("_", " ")} to AS$0` }];
-      }),
-      ...scheme.blackhole !== undefined ? [
-        {
-          community: written(scheme.blackhole.function, 0),
-          description: `Blackhole: dropped in AS${asn}, and by the upstreams that take it`
-        }
-      ] : []
-    ];
-    return {
-      community,
-      learned_from: learnedFrom,
-      tag,
-      actions,
-      blackholeExport,
-      rejectDoNotAnnounce,
-      prepends,
-      stripOurs,
-      blackhole,
-      catalogue
-    };
-  }
-  static article(word) {
-    return /^[aeiou]/i.test(word) ? `an ${word}` : `a ${word}`;
-  }
-}
-// src/helpers/cables.ts
-class Cables {
-  static link(spec) {
-    return {
-      a: { [spec.a.port]: Cables.end(spec, spec.b, spec.b.port) },
-      b: { [spec.b.port]: Cables.end(spec, spec.a, spec.a.port) }
-    };
-  }
-  static lag(spec) {
-    const pairs = Object.entries(spec.cables);
-    const taken = new Map;
-    for (const [near, far] of pairs) {
-      const other = taken.get(far);
-      if (other)
-        throw new Error(`Cables.lag: ${spec.b.device} ${far} is cabled to both ${other} and ${near} on ${spec.a.device}`);
-      taken.set(far, near);
-    }
-    const a = Object.fromEntries(pairs.map(([near, far]) => [near, { ...Cables.end(spec, spec.b, far), lag: spec.a.lag }]));
-    const b = Object.fromEntries(pairs.map(([near, far]) => [far, { ...Cables.end(spec, spec.a, near), lag: spec.b.lag }]));
-    return {
-      a,
-      b
-    };
-  }
-  static end(shared, far, port) {
-    const label = far.platform && far.model ? Catalog.spell(far.platform, far.model, port) : undefined;
-    return {
-      link: { device: far.device, port, ...shared.through ? { through: shared.through } : {} },
-      ...shared.describe ? { description: shared.describe({ device: far.device, port, ...label ? { label } : {} }) } : {}
-    };
-  }
-}
-// src/helpers/checks.ts
-class Checks {
-  static exportsEndInReject = (devices) => {
-    const findings = [];
-    for (const device of devices) {
-      for (const neighbor of Bgp.neighborPolicies(device)) {
-        if (neighbor.role === "customer")
-          continue;
-        const last = neighbor.export ? device.policies?.[neighbor.export]?.at(-1) : undefined;
-        if (neighbor.export && (last?.action !== "reject" || last.match)) {
-          findings.push({
-            level: "error",
-            device: device.name,
-            message: `${neighbor.name}: export ${neighbor.export} does not end in an unconditional reject`
-          });
-        }
-      }
-    }
-    return findings;
-  };
-  static importsEndInAcceptOrReject = (devices) => {
-    const findings = [];
-    for (const device of devices) {
-      for (const neighbor of Bgp.neighborPolicies(device)) {
-        const last = neighbor.import ? device.policies?.[neighbor.import]?.at(-1) : undefined;
-        if (neighbor.import && (!last?.action || last.match)) {
-          findings.push({
-            level: "error",
-            device: device.name,
-            message: `${neighbor.name}: import ${neighbor.import} does not end in an unconditional accept or reject`
-          });
-        }
-      }
-    }
-    return findings;
-  };
-  static tunnelsOutsideOffered = (devices) => {
-    const findings = [];
-    for (const device of devices) {
-      for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-        if (iface.type !== "gre" && iface.type !== "vxlan")
-          continue;
-        const subnets = (iface.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
-        for (const neighbor of Bgp.neighborPolicies(device)) {
-          if (!subnets.some((subnet) => Address2.contains(subnet, neighbor.address)))
-            continue;
-          for (const prefix of Bgp.offered(device, neighbor.export)) {
-            if (Address2.contains(prefix, iface.local)) {
-              findings.push({
-                level: "error",
-                device: device.name,
-                message: `${name} is sourced from ${iface.local}, inside ${prefix}, which ${neighbor.name} is offered`
-              });
-            }
-          }
-        }
-      }
-    }
-    return findings;
-  };
-  static nativeVlansAreDeadEnds = (devices) => {
-    const findings = [];
-    for (const device of devices) {
-      const carriers = [
-        ...Object.entries(device.ports ?? {}).flatMap(([name, port]) => port ? [{ what: `port ${name}`, settings: port }] : []),
-        ...Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) => iface.type === "lag" ? [{ what: `LAG ${name}`, settings: iface }] : [])
-      ];
-      const nativeOn = new Map;
-      for (const { what, settings } of carriers) {
-        if (settings.native_vlan)
-          nativeOn.set(settings.native_vlan, [...nativeOn.get(settings.native_vlan) ?? [], what]);
-      }
-      for (const [vlan, trunks] of nativeOn) {
-        const report = (message) => findings.push({ level: "error", device: device.name, message: `native VLAN ${vlan} ${message}` });
-        if (trunks.length > 1)
-          report(`is native on ${trunks.join(", ")}: give each trunk its own`);
-        const members = carriers.filter(({ settings }) => Checks.vlansOf(settings).includes(vlan));
-        for (const { what } of members)
-          report(`is also an access or tagged VLAN on ${what}`);
-      }
-    }
-    return findings;
-  };
-  static vlansOf(port) {
-    return [port.access_vlan, ...port.trunk_vlans ?? []].filter((vlan) => vlan !== undefined);
-  }
-  static trustBoundary(boundary) {
-    return (devices) => {
-      const untrusted = new Set(boundary.untrusted);
-      const routers = new Set(boundary.routers);
-      const extended = (a, b) => (boundary.extended ?? []).some(([x, y]) => x === a && y === b || x === b && y === a);
-      const findings = [];
-      for (const device of devices) {
-        const isRouter = routers.has(device.name);
-        const ports = Object.entries(device.ports ?? {}).flatMap(([name, port]) => port ? [{ name, port }] : []);
-        const carriers = [
-          ...ports.filter(({ port }) => !port.lag).map(({ name, port }) => ({
-            what: `port ${name}`,
-            carried: Checks.vlansOf(port),
-            faces: port.link ? [port.link.device] : []
-          })),
-          ...Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) => iface.type === "lag" ? [
-            {
-              what: `LAG ${name}`,
-              carried: Checks.vlansOf(iface),
-              faces: ports.filter(({ port }) => port.lag === name && port.link).map(({ port }) => port.link.device)
-            }
-          ] : [])
-        ];
-        for (const { what, carried, faces } of carriers) {
-          const mixes = carried.some((vlan) => untrusted.has(vlan)) && carried.some((vlan) => !untrusted.has(vlan));
-          const facesRouter = isRouter || faces.some((name) => routers.has(name));
-          const isExtension = faces.length > 0 && faces.every((name) => extended(device.name, name));
-          if (mixes && !facesRouter && !isExtension) {
-            findings.push({
-              level: "error",
-              device: device.name,
-              message: `${what} carries an untrusted VLAN beside a trusted one and does not face a router`
-            });
-          }
-        }
-        if (isRouter)
-          continue;
-        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-          if (iface.type === "vlan" && untrusted.has(iface.vlan)) {
-            findings.push({
-              level: "error",
-              device: device.name,
-              message: `interface ${name} puts an address on untrusted VLAN ${iface.vlan}; only a router may`
-            });
-          }
-        }
-      }
-      return findings;
-    };
-  }
-}
-// src/helpers/route-server.ts
-class RouteServerConfig {
-  static LENGTHS = {
-    ipv4: { shortest: 8, longest: 24 },
-    ipv6: { shortest: 12, longest: 48 }
-  };
-  static RULES = [
-    "# 1. the first AS in its path is the member's own,",
-    "# 2. its next hop is the member's own address on the peering LAN,",
-    "# 3. it is not inside the peering LAN,",
-    `# 4. it is /${RouteServerConfig.LENGTHS.ipv4.shortest} to /${RouteServerConfig.LENGTHS.ipv4.longest} long for IPv4, /${RouteServerConfig.LENGTHS.ipv6.shortest} to /${RouteServerConfig.LENGTHS.ipv6.longest} for IPv6.`
-  ];
-  static bird(server, lan, members) {
-    const families = RouteServerConfig.families(server, lan);
-    const sessions = [];
-    const names = new Map;
-    for (const member of members) {
-      for (const family of families) {
-        const neighbor = member[family];
-        if (!neighbor)
-          continue;
-        const name = RouteServerConfig.protocolName(member.name, family);
-        const holder = names.get(name);
-        if (holder)
-          throw new Error(`members ${holder} and ${member.name} would both have session ${name}`);
-        names.set(name, member.name);
-        sessions.push(RouteServerConfig.birdSession(name, server, member, family, neighbor, lan[family]));
-      }
-    }
-    const header = [
-      `# ${server.name}, a route server of the exchange, for BIRD 2.`,
-      "# Circuit wrote it from the member list: change the list, not this file.",
-      "",
-      `router id ${server.router_id};`,
-      "",
-      "# Learns the server's interfaces and addresses. It sends no route anywhere.",
-      "protocol device {",
-      "}",
-      "",
-      "# One session per member and family. A route a member sends is kept only when:",
-      ...RouteServerConfig.RULES,
-      "# Every member gets every route the others sent, as they sent it.",
-      "# A route that is not kept stays visible: birdc show route filtered."
-    ];
-    return [...header, ...sessions.flatMap((session) => ["", session])].join(`
-`) + `
-`;
-  }
-  static openbgpd(server, lan, members) {
-    const families = RouteServerConfig.families(server, lan).filter((family) => members.some((member) => member[family]));
-    const lines = [
-      `# ${server.name}, a route server of the exchange, for OpenBGPD.`,
-      "# Circuit wrote it from the member list: change the list, not this file.",
-      "",
-      `AS ${server.asn}`,
-      `router-id ${server.router_id}`,
-      "",
-      "# The server passes routes on and carries no traffic, so it keeps them out of its own routing table.",
-      "fib-update no",
-      "",
-      "# Members see each other's paths as they were sent: the server never adds its own AS, and passes MED and communities on untouched.",
-      "transparent-as yes",
-      "",
-      "# A route that is not kept stays visible: bgpctl show rib filtered.",
-      "rde rib Loc-RIB include filtered"
-    ];
-    for (const family of families) {
-      lines.push("", ...RouteServerConfig.openbgpdGroup(server, family, members));
-    }
-    lines.push("", "# A route a member sends is kept only when:", ...RouteServerConfig.RULES);
-    lines.push("# The last rule a route matches decides, and a route no rule allows is dropped.");
-    for (const family of families) {
-      const { shortest, longest } = RouteServerConfig.LENGTHS[family];
-      const any = family === "ipv4" ? "0.0.0.0/0" : "::/0";
-      lines.push(`allow from group "${family} members" peer-as neighbor-as nexthop neighbor prefix ${any} prefixlen ${shortest} - ${longest}`);
-    }
-    for (const family of families) {
-      lines.push(`deny from any prefix ${Address2.prefixOf(lan[family])} or-longer`);
-    }
-    lines.push("", "# Every member gets every route the others sent, as they sent it.", "allow to any");
-    return lines.join(`
-`) + `
-`;
-  }
-  static families(server, lan) {
-    const families = ["ipv4", "ipv6"].filter((family) => server[family]);
-    if (!families.length)
-      throw new Error(`route server ${server.name} has no address on the peering LAN`);
-    for (const family of families) {
-      const prefix = lan[family];
-      const address = server[family];
-      if (!prefix || !Address2.contains(prefix, address))
-        throw new Error(`${address} of route server ${server.name} is outside the peering LAN`);
-    }
-    return families;
-  }
-  static protocolName(member, family) {
-    const name = `${member.toLowerCase().replace(/[^a-z0-9_]/g, "_")}_${family}`;
-    return /^[a-z]/.test(name) ? name : `m_${name}`;
-  }
-  static description(member) {
-    return `"${member.name.replace(/["\\]/g, "")}, AS${member.asn}"`;
-  }
-  static birdSession(name, server, member, family, neighbor, lan) {
-    const { shortest, longest } = RouteServerConfig.LENGTHS[family];
-    return [
-      `protocol bgp ${name} {`,
-      `    description ${RouteServerConfig.description(member)};`,
-      `    local ${server[family]} as ${server.asn};`,
-      `    neighbor ${neighbor} as ${member.asn};`,
-      "    rs client;",
-      `    ${family} {`,
-      "        import keep filtered on;",
-      "        import filter {",
-      `            if bgp_path.first != ${member.asn} then reject;`,
-      `            if bgp_next_hop != ${neighbor} then reject;`,
-      `            if net ~ [ ${Address2.prefixOf(lan)}+ ] then reject;`,
-      `            if net.len < ${shortest} || net.len > ${longest} then reject;`,
-      "            accept;",
-      "        };",
-      "        export all;",
-      "    };",
-      "}"
-    ].join(`
-`);
-  }
-  static openbgpdGroup(server, family, members) {
-    const lines = [
-      `# One session per member with an ${family === "ipv4" ? "IPv4" : "IPv6"} address.`,
-      `group "${family} members" {`,
-      `    local-address ${server[family]}`,
-      "    # A route whose first AS is not the member's own is dropped by the rules below. The default would close the whole session.",
-      "    enforce neighbor-as no"
-    ];
-    for (const member of members) {
-      const neighbor = member[family];
-      if (!neighbor)
-        continue;
-      lines.push(`    neighbor ${neighbor} {`, `        remote-as ${member.asn}`, `        descr ${RouteServerConfig.description(member)}`, "    }");
-    }
-    lines.push("}");
-    return lines;
-  }
-}
-
-// src/helpers/exchange.ts
-class Exchange {
-  static build(exchange, members) {
-    const percent = exchange.storm_percent ?? 1;
-    const ports = (device) => {
-      const result = {};
-      for (const member of members) {
-        const port = member.ports[device];
-        if (!port)
-          continue;
-        result[port] = {
-          description: `${member.name}, AS${member.asn}`,
-          access_vlan: exchange.vlan,
-          stp: exchange.stp ?? false,
-          lldp: exchange.lldp ?? false,
-          storm_control: { broadcast: { percent }, multicast: { percent }, unknown_unicast: { percent } },
-          ...exchange.mac_limit !== undefined ? { mac_limit: exchange.mac_limit } : {},
-          ...exchange.ethertypes ? { ethertypes: exchange.ethertypes } : {}
-        };
-      }
-      return result;
-    };
-    const check = (devices) => {
-      const findings = [];
-      const error = (message, device) => findings.push({ level: "error", ...device ? { device } : {}, message });
-      const taken = new Map((exchange.reserved ?? []).map((address) => [address, "reserved"]));
-      const portHolders = new Map;
-      members.forEach((member, index) => {
-        for (const other of members.slice(index + 1)) {
-          if (other.name === member.name)
-            error(`member ${member.name} is declared twice`);
-          if (other.asn === member.asn)
-            error(`members ${member.name} and ${other.name} share AS${member.asn}`);
-        }
-        for (const [address, lan] of [
-          [member.ipv4, exchange.lan.ipv4],
-          [member.ipv6, exchange.lan.ipv6]
-        ]) {
-          if (!address)
-            continue;
-          if (!lan || !Address2.contains(lan, address))
-            error(`${address} of ${member.name} is outside the peering LAN`);
-          const holder = taken.get(address);
-          if (holder)
-            error(`${address} of ${member.name} is already ${holder === "reserved" ? "reserved" : `${holder}'s`}`);
-          taken.set(address, member.name);
-        }
-        for (const [deviceName, portName] of Object.entries(member.ports)) {
-          const holder = portHolders.get(`${deviceName} ${portName}`);
-          if (holder)
-            error(`port ${portName} is given to both ${holder} and ${member.name}`, deviceName);
-          portHolders.set(`${deviceName} ${portName}`, member.name);
-          const device = devices.find((candidate) => candidate.name === deviceName);
-          const port = device?.ports?.[portName];
-          const carried = port ? Checks.vlansOf(port) : [];
-          if (carried.length !== 1 || carried[0] !== exchange.vlan) {
-            error(`port ${portName} of ${member.name} does not carry the peering VLAN alone`, deviceName);
-          }
-        }
-      });
-      return findings;
-    };
-    const bird = (server) => RouteServerConfig.bird(server, exchange.lan, members);
-    const openbgpd = (server) => RouteServerConfig.openbgpd(server, exchange.lan, members);
-    return { ports, check, bird, openbgpd };
-  }
-}
-// src/helpers/filters.ts
-class Filters {
-  static MARTIANS = ["127.0.0.0/8", "169.254.0.0/16", "0.0.0.0/8"];
-  static PRIVATE_RANGES = ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"];
-  static AMPLIFIERS = {
-    qotd: 17,
-    chargen: 19,
-    dns: 53,
-    portmap: 111,
-    ntp: 123,
-    netbios: 137,
-    snmp: 161,
-    cldap: 389,
-    slp: 427,
-    rip: 520,
-    "ms-sql": 1434,
-    ssdp: 1900,
-    ard: 3283,
-    "ws-discovery": 3702,
-    mdns: 5353,
-    coap: 5683,
-    ubiquiti: 10001,
-    memcached: 11211,
-    dvr: 37810
-  };
-  static ASKED = new Set([Filters.AMPLIFIERS.dns, Filters.AMPLIFIERS.ntp, Filters.AMPLIFIERS.snmp]);
-  static BAD_TCP_FLAGS = [
-    ["FIN+SYN", ["fin", "syn"], []],
-    ["SYN+RST", ["syn", "rst"], []],
-    ["FIN+RST", ["fin", "rst"], []],
-    ["FIN without ACK", ["fin"], ["ack"]],
-    ["FIN+URG", ["fin", "urg"], []],
-    ["Xmas scan", ["fin", "syn", "psh", "urg"], []]
-  ];
-  static antiSpoofing(vlan, sources) {
-    return sources.map((src) => ({
-      description: `${vlan}: drop source ${src}`,
-      match: { vlan, src },
-      action: "drop"
-    }));
-  }
-  static antiAmplification(destinations, options = {}) {
-    return destinations.flatMap((dst) => [
-      ...(options.keep_fragments ?? []).filter((prefix) => Address2.contains(dst, prefix)).map((prefix) => ({
-        description: `UDP fragments to ${prefix} kept`,
-        match: { protocol: "udp", dst: prefix, src_port: 0 },
-        action: "accept"
-      })),
-      { description: `UDP fragments to ${dst}`, match: { protocol: "udp", dst, src_port: 0 }, action: "drop" },
-      ...Object.entries(Filters.AMPLIFIERS).flatMap(([name, port]) => Filters.ASKED.has(port) ? [
-        {
-          description: `UDP to ${dst} from ${name}, between two servers`,
-          match: { protocol: "udp", dst, src_port: port, dst_port: port },
-          action: "accept"
-        },
-        {
-          description: `UDP to ${dst} from ${name}, to a port below 1024`,
-          match: { protocol: "udp", dst, src_port: port, dst_port: { min: 0, max: 1023 } },
-          action: "drop"
-        }
-      ] : [{ description: `UDP to ${dst} from ${name}`, match: { protocol: "udp", dst, src_port: port }, action: "drop" }])
-    ]);
-  }
-  static badTcpFlags() {
-    return Filters.BAD_TCP_FLAGS.map(([name, set, unset]) => ({
-      description: `Bad flags ${name}`,
-      match: { protocol: "tcp", tcp_flags: { set, unset } },
-      action: "drop"
-    }));
-  }
-}
-// src/helpers/upstreams.ts
-class Upstreams {
-  static catalog(catalog) {
-    return catalog;
-  }
-  static doNotAnnounceTo(upstream, asns, description) {
-    if (!asns.length)
-      return [];
-    const community = upstream.communities?.do_not_announce_to;
-    if (!community)
-      throw new Error(`Upstreams: ${upstream.name ?? `AS${upstream.asn}`} has no communities.do_not_announce_to, so it can't be asked to keep our routes from AS${asns.join(", AS")}`);
-    const communities = asns.map(community);
-    const large = communities.filter((value) => value.split(":").length === 3);
-    const standard = communities.filter((value) => value.split(":").length === 2);
-    return [
-      {
-        description,
-        set: {
-          ...standard.length ? { add_communities: standard } : {},
-          ...large.length ? { add_large_communities: large } : {}
-        }
-      }
-    ];
-  }
-  static define(catalog, options = {}) {
-    const all = Object.entries(catalog);
-    const nameOf = (key, upstream) => upstream.name ?? key;
-    const unique = (what, names) => {
-      const taken = new Map;
-      for (const [key, name] of names) {
-        if (name === undefined)
-          continue;
-        const other = taken.get(name);
-        if (other)
-          throw new Error(`Upstreams: ${other} and ${key} both have the ${what} ${name}`);
-        taken.set(name, key);
-      }
-    };
-    unique("VLAN", [
-      ...all.map(([key, upstream]) => [key, upstream.handoff?.vlan.name]),
-      ...all.map(([key, upstream]) => [key, upstream.handoff?.native?.name])
-    ]);
-    unique("interface", all.map(([key, upstream]) => [key, upstream.handoff?.interface ?? upstream.tunnel?.interface]));
-    unique("policy", [
-      ...all.map(([key, upstream]) => [key, upstream.import?.name]),
-      ...all.map(([key, upstream]) => [key, upstream.export.name])
-    ]);
-    unique("BGP group", all.map(([key, upstream]) => [key, upstream.group]));
-    const vlans = (device) => {
-      const result = {};
-      for (const [key, upstream] of all) {
-        const handoff = upstream.handoff;
-        if (!handoff || device !== undefined && handoff.port?.device !== device)
-          continue;
-        result[handoff.vlan.name] = { id: handoff.vlan.id, description: nameOf(key, upstream) };
-        if (handoff.native) {
-          result[handoff.native.name] = {
-            id: handoff.native.id,
-            description: `Native toward ${nameOf(key, upstream)}, nothing else in it`
-          };
-        }
-      }
-      return result;
-    };
-    const vlansOn = (device) => all.flatMap(([, upstream]) => upstream.handoff?.port?.device === device ? [upstream.handoff.vlan.name] : []);
-    const ports = (device) => {
-      const result = {};
-      for (const [key, upstream] of all) {
-        const handoff = upstream.handoff;
-        if (!handoff?.port || handoff.port.device !== device)
-          continue;
-        result[handoff.port.port] = {
-          description: nameOf(key, upstream),
-          ...handoff.native ? { trunk_vlans: [handoff.vlan.name], native_vlan: handoff.native.name } : { access_vlan: handoff.vlan.name },
-          lldp: handoff.port.lldp ?? false,
-          stp: handoff.port.stp ?? false,
-          ...handoff.port.storm_control ? { storm_control: handoff.port.storm_control } : {}
-        };
-      }
-      return result;
-    };
-    const interfaces = () => {
-      const result = {};
-      for (const [key, upstream] of all) {
-        const description = nameOf(key, upstream);
-        if (upstream.tunnel) {
-          const { interface: name, local, remote, addresses, mtu } = upstream.tunnel;
-          result[name] = { type: "gre", description, local, remote, addresses, ...mtu ? { mtu } : {} };
-        } else if (upstream.handoff) {
-          const { interface: name, vlan, addresses, exchange } = upstream.handoff;
-          result[name] = { type: "vlan", vlan: vlan.name, description, addresses, ...exchange ? { exchange } : {} };
-        }
-      }
-      return result;
-    };
-    const uplinks = () => all.flatMap(([, upstream]) => upstream.handoff ? [upstream.handoff.interface] : []);
-    const settings = (key, upstream) => {
-      const multihop = upstream.multihop;
-      return {
-        remote_as: upstream.asn,
-        description: nameOf(key, upstream),
-        role: upstream.role,
-        ...upstream.import ? { import: upstream.import.name } : {},
-        export: upstream.export.name,
-        ...upstream.table ? { table: upstream.table } : {},
-        ...multihop ? {
-          local_address: multihop.local_address,
-          multihop: true,
-          ...multihop.families ? { families: multihop.families } : {},
-          ...multihop.password ? { password: multihop.password } : {}
-        } : {}
-      };
-    };
-    const groups = () => Object.fromEntries(all.flatMap(([key, upstream]) => upstream.group ? [[upstream.group, settings(key, upstream)]] : []));
-    const neighbors = () => Object.fromEntries(all.flatMap(([key, upstream]) => Object.entries(upstream.sessions).map(([name, session]) => {
-      const limit = upstream.limits?.[Address2.family(session.address)];
-      return [
-        name,
-        {
-          ...upstream.group ? { group: upstream.group } : settings(key, upstream),
-          ...session,
-          ...limit ? { max_prefixes: limit } : {}
-        }
-      ];
-    })));
-    const policies = () => {
-      const result = {};
-      for (const [key, upstream] of all) {
-        if (upstream.import) {
-          const rules = upstream.import.rules;
-          result[upstream.import.name] = options.mapImports ? options.mapImports(rules, key, upstream) : rules;
-        }
-        const rules = upstream.export.rules;
-        result[upstream.export.name] = options.mapExports ? options.mapExports(rules, key, upstream) : rules;
-      }
-      return result;
-    };
-    const untrusted = () => [
-      ...all.flatMap(([, upstream]) => upstream.handoff ? [upstream.handoff.vlan.name] : []),
-      ...natives()
-    ];
-    const natives = () => all.flatMap(([, upstream]) => upstream.handoff?.native ? [upstream.handoff.native.name] : []);
-    const privateDrops = () => all.flatMap(([, upstream]) => upstream.handoff && upstream.drop_private ? [upstream.handoff.vlan.name] : []);
-    const tunnelRules = () => all.flatMap(([key, upstream]) => upstream.tunnel ? [
-      {
-        description: `GRE from ${nameOf(key, upstream)}`,
-        match: {
-          protocol: "gre",
-          src: `${upstream.tunnel.remote}/${Address2.bits(Address2.family(upstream.tunnel.remote))}`
-        },
-        action: "accept"
-      }
-    ] : []);
-    const addresses = () => all.flatMap(([, upstream]) => Object.values(upstream.sessions).map((session) => session.address));
-    return {
-      vlans,
-      vlansOn,
-      ports,
-      interfaces,
-      uplinks,
-      groups,
-      neighbors,
-      policies,
-      untrusted,
-      natives,
-      privateDrops,
-      tunnelRules,
-      addresses
-    };
-  }
-}
-export {
-  Bgp,
-  Cables,
-  Checks,
-  Exchange,
-  Filters,
-  RouteServerConfig,
-  Upstreams
-};