@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/src/helpers/checks.ts

@@ -1,201 +0,0 @@
-import { Address } from "../core/address";
-import type { Check, Finding } from "../core/define";
-import { Bgp } from "./bgp";
-
-/** Where traffic from outside, before anything filters it, may go. Every VLAN not listed as untrusted is trusted, so a VLAN added later is protected without being listed. */
-export type TrustBoundary = {
-    /** VLANs carrying traffic straight from outside: transits, exchanges, an ISP handoff. */
-    untrusted: readonly string[];
-    /** The devices that filter: the only ones that may give an untrusted VLAN an address, and the only ones a port carrying both kinds may face. */
-    routers: readonly string[];
-    /**
-     * Links between two switches that may carry both kinds, each named by its two devices: a site's switch extended to another building, with an exchange's VLAN and its own management on one cable. Neither end gives an untrusted VLAN an address.
-     */
-    extended?: readonly (readonly [string, string])[];
-};
-
-/** Checks for `checks` in `defineNetwork`, and helpers for checks of your own. */
-export class Checks {
-    /**
-     * Every BGP export ends in a reject that matches everything, so nothing leaves by accident. An export to a neighbor whose `role` is `customer` is left out: sending a customer everything you know is what it pays for, and cannot leak a route to the rest of the internet.
-     */
-    static readonly exportsEndInReject: Check = (devices) => {
-        const findings: Finding[] = [];
-
-        for (const device of devices) {
-            for (const neighbor of Bgp.neighborPolicies(device)) {
-                if (neighbor.role === "customer") continue;
-
-                const last = neighbor.export ? device.policies?.[neighbor.export]?.at(-1) : undefined;
-
-                if (neighbor.export && (last?.action !== "reject" || last.match)) {
-                    findings.push({
-                        level: "error",
-                        device: device.name,
-                        message: `${neighbor.name}: export ${neighbor.export} does not end in an unconditional reject`,
-                    });
-                }
-            }
-        }
-
-        return findings;
-    };
-
-    /**
-     * Every BGP import ends in a rule that decides for every route, an accept or a reject without a match, so what the import takes is written in it and not left to the platform's default.
-     */
-    static readonly importsEndInAcceptOrReject: Check = (devices) => {
-        const findings: Finding[] = [];
-
-        for (const device of devices) {
-            for (const neighbor of Bgp.neighborPolicies(device)) {
-                const last = neighbor.import ? device.policies?.[neighbor.import]?.at(-1) : undefined;
-
-                if (neighbor.import && (!last?.action || last.match)) {
-                    findings.push({
-                        level: "error",
-                        device: device.name,
-                        message: `${neighbor.name}: import ${neighbor.import} does not end in an unconditional accept or reject`,
-                    });
-                }
-            }
-        }
-
-        return findings;
-    };
-
-    /** A GRE or VXLAN tunnel's local address is outside what the neighbors over it are offered, or their replies route back into the tunnel. */
-    static readonly tunnelsOutsideOffered: Check = (devices) => {
-        const findings: Finding[] = [];
-
-        for (const device of devices) {
-            for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-                if (iface.type !== "gre" && iface.type !== "vxlan") continue;
-
-                const subnets = (iface.addresses ?? []).map((entry) => (typeof entry === "string" ? entry : entry.address));
-
-                for (const neighbor of Bgp.neighborPolicies(device)) {
-                    if (!subnets.some((subnet) => Address.contains(subnet, neighbor.address))) continue;
-
-                    for (const prefix of Bgp.offered(device, neighbor.export)) {
-                        if (Address.contains(prefix, iface.local)) {
-                            findings.push({
-                                level: "error",
-                                device: device.name,
-                                message: `${name} is sourced from ${iface.local}, inside ${prefix}, which ${neighbor.name} is offered`,
-                            });
-                        }
-                    }
-                }
-            }
-        }
-
-        return findings;
-    };
-
-    /**
-     * A native VLAN is a dead end: native on one trunk (a port or a LAG) of a device at most, and never an access VLAN or a tagged VLAN anywhere on that device. On a switch, a native VLAN is an untagged member of every trunk it is native on, so one native VLAN shared by two trunks joins them: every untagged frame from one leaves on the other.
-     */
-    static readonly nativeVlansAreDeadEnds: Check = (devices) => {
-        const findings: Finding[] = [];
-
-        for (const device of devices) {
-            const carriers = [
-                ...Object.entries(device.ports ?? {}).flatMap(([name, port]) => (port ? [{ what: `port ${name}`, settings: port }] : [])),
-                ...Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) =>
-                    iface.type === "lag" ? [{ what: `LAG ${name}`, settings: iface }] : []
-                ),
-            ];
-
-            const nativeOn = new Map<string, string[]>();
-            for (const { what, settings } of carriers) {
-                if (settings.native_vlan) nativeOn.set(settings.native_vlan, [...(nativeOn.get(settings.native_vlan) ?? []), what]);
-            }
-
-            for (const [vlan, trunks] of nativeOn) {
-                const report = (message: string) =>
-                    findings.push({ level: "error", device: device.name, message: `native VLAN ${vlan} ${message}` });
-
-                if (trunks.length > 1) report(`is native on ${trunks.join(", ")}: give each trunk its own`);
-
-                const members = carriers.filter(({ settings }) => Checks.vlansOf(settings).includes(vlan));
-                for (const { what } of members) report(`is also an access or tagged VLAN on ${what}`);
-            }
-        }
-
-        return findings;
-    };
-
-    /** The VLANs a port carries, untagged or tagged. */
-    static vlansOf(port: { access_vlan?: string; trunk_vlans?: readonly string[] }): string[] {
-        return [port.access_vlan, ...(port.trunk_vlans ?? [])].filter((vlan): vlan is string => vlan !== undefined);
-    }
-
-    /** A check: traffic from outside reaches your own VLANs only through a router. A port or LAG carrying an untrusted VLAN beside any other is on a router or faces one, and only a router gives an untrusted VLAN an address. */
-    static trustBoundary(boundary: TrustBoundary): Check {
-        return (devices) => {
-            const untrusted = new Set(boundary.untrusted);
-            const routers = new Set(boundary.routers);
-            const extended = (a: string, b: string) =>
-                (boundary.extended ?? []).some(([x, y]) => (x === a && y === b) || (x === b && y === a));
-            const findings: Finding[] = [];
-
-            for (const device of devices) {
-                const isRouter = routers.has(device.name);
-                const ports = Object.entries(device.ports ?? {}).flatMap(([name, port]) => (port ? [{ name, port }] : []));
-
-                // What carries VLANs: a port on its own, or a LAG, which faces whatever its members link to.
-                const carriers = [
-                    ...ports
-                        .filter(({ port }) => !port.lag)
-                        .map(({ name, port }) => ({
-                            what: `port ${name}`,
-                            carried: Checks.vlansOf(port),
-                            faces: port.link ? [port.link.device] : [],
-                        })),
-                    ...Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) =>
-                        iface.type === "lag"
-                            ? [
-                                  {
-                                      what: `LAG ${name}`,
-                                      carried: Checks.vlansOf(iface),
-                                      faces: ports
-                                          .filter(({ port }) => port.lag === name && port.link)
-                                          .map(({ port }) => port.link!.device),
-                                  },
-                              ]
-                            : []
-                    ),
-                ];
-
-                for (const { what, carried, faces } of carriers) {
-                    const mixes = carried.some((vlan) => untrusted.has(vlan)) && carried.some((vlan) => !untrusted.has(vlan));
-                    const facesRouter = isRouter || faces.some((name) => routers.has(name));
-                    const isExtension = faces.length > 0 && faces.every((name) => extended(device.name, name));
-
-                    if (mixes && !facesRouter && !isExtension) {
-                        findings.push({
-                            level: "error",
-                            device: device.name,
-                            message: `${what} carries an untrusted VLAN beside a trusted one and does not face a router`,
-                        });
-                    }
-                }
-
-                if (isRouter) continue;
-
-                for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-                    if (iface.type === "vlan" && untrusted.has(iface.vlan)) {
-                        findings.push({
-                            level: "error",
-                            device: device.name,
-                            message: `interface ${name} puts an address on untrusted VLAN ${iface.vlan}; only a router may`,
-                        });
-                    }
-                }
-            }
-
-            return findings;
-        };
-    }
-}

package/src/helpers/exchange.ts

@@ -1,123 +0,0 @@
-import { Address } from "../core/address";
-import type { Check, Finding } from "../core/define";
-import type { Ethertype, IP, Port, Prefix } from "../schema";
-import { Checks } from "./checks";
-import { RouteServerConfig, type RouteServer } from "./route-server";
-
-/** A member of an internet exchange: a network with a port on the fabric and an address on the peering LAN. */
-export type ExchangeMember = {
-    /** Lowercase, and never reused. */
-    name: string;
-    asn: number;
-    /** The member's port on each fabric switch, by switch name. */
-    ports: Readonly<Record<string, string>>;
-    /** Its addresses on the peering LAN. The route servers peer with these. */
-    ipv4?: IP;
-    ipv6?: IP;
-};
-
-/** An internet exchange's peering LAN, as its fabric carries it. */
-export type InternetExchange<V extends string> = {
-    /** The peering VLAN, by the name the fabric switches give it. */
-    vlan: V;
-    /** The peering LAN's subnets. */
-    lan: { ipv4?: Prefix; ipv6?: Prefix };
-    /** Addresses on the peering LAN no member may take, such as the route servers'. */
-    reserved?: readonly IP[];
-    /** How much broadcast, multicast and unknown unicast a member port lets through, in percent of its speed. 1 when absent. */
-    storm_percent?: number;
-    /** The most MAC addresses a member port learns, usually 1. No limit when absent. No platform renders it yet, so `validate` refuses it. */
-    mac_limit?: number;
-    /** The only kinds of frame a member port takes in, usually `ipv4`, `ipv6` and `arp`. Every kind when absent. No platform renders it yet, so `validate` refuses it. */
-    ethertypes?: readonly Ethertype[];
-    /** LLDP on member ports. Off when absent: a member's router has no business learning the fabric. */
-    lldp?: boolean;
-    /** Spanning tree on member ports. Off when absent: a member's port faces a router, which must not join the fabric's spanning tree. */
-    stp?: boolean;
-};
-
-/** An internet exchange's fabric: its member ports, a check of its members, and its route servers' config. */
-export class Exchange {
-    /**
-     * Member ports and a check for an internet exchange's fabric.
-     *
-     * - `ports(device)`: every member's port on one switch, each written as
-     *   `{ description: "<name>, AS<asn>", access_vlan: vlan, stp: false, lldp: false, storm_control: { broadcast, multicast, unknown_unicast: { percent: storm_percent } } }`,
-     *   plus `mac_limit` and `ethertypes` when the exchange sets them. `stp` and `lldp` are the exchange's own when it sets them, and storm control is 1 % when `storm_percent` is absent.
-     * - `check`: members never share a name, an AS, an address or a port; every address is inside the peering LAN and not reserved; every member port carries the peering VLAN alone.
-     * - `bird(server)`: one route server's BIRD 2 config, with a session to every member. Write it to a file for the server; Circuit never logs in to a route server.
-     * - `openbgpd(server)`: the same route server's config for OpenBGPD, its `bgpd.conf`, with the same sessions and the same rules.
-     */
-    static build<const V extends string>(exchange: InternetExchange<V>, members: readonly ExchangeMember[]) {
-        const percent = exchange.storm_percent ?? 1;
-
-        const ports = (device: string) => {
-            const result: Record<string, Port<V, string, string, string>> = {};
-
-            for (const member of members) {
-                const port = member.ports[device];
-                if (!port) continue;
-
-                result[port] = {
-                    description: `${member.name}, AS${member.asn}`,
-                    access_vlan: exchange.vlan,
-                    stp: exchange.stp ?? false,
-                    lldp: exchange.lldp ?? false,
-                    storm_control: { broadcast: { percent }, multicast: { percent }, unknown_unicast: { percent } },
-                    ...(exchange.mac_limit !== undefined ? { mac_limit: exchange.mac_limit } : {}),
-                    ...(exchange.ethertypes ? { ethertypes: exchange.ethertypes } : {}),
-                };
-            }
-
-            return result;
-        };
-
-        const check: Check = (devices) => {
-            const findings: Finding[] = [];
-            const error = (message: string, device?: string) => findings.push({ level: "error", ...(device ? { device } : {}), message });
-            const taken = new Map<string, string>((exchange.reserved ?? []).map((address) => [address, "reserved"]));
-            // `ports()` writes one port per name, so a second member on a port would silently replace the first.
-            const portHolders = new Map<string, string>();
-
-            members.forEach((member, index) => {
-                for (const other of members.slice(index + 1)) {
-                    if (other.name === member.name) error(`member ${member.name} is declared twice`);
-                    if (other.asn === member.asn) error(`members ${member.name} and ${other.name} share AS${member.asn}`);
-                }
-
-                for (const [address, lan] of [
-                    [member.ipv4, exchange.lan.ipv4],
-                    [member.ipv6, exchange.lan.ipv6],
-                ] as const) {
-                    if (!address) continue;
-                    if (!lan || !Address.contains(lan, address)) error(`${address} of ${member.name} is outside the peering LAN`);
-
-                    const holder = taken.get(address);
-                    if (holder) error(`${address} of ${member.name} is already ${holder === "reserved" ? "reserved" : `${holder}'s`}`);
-                    taken.set(address, member.name);
-                }
-
-                for (const [deviceName, portName] of Object.entries(member.ports)) {
-                    const holder = portHolders.get(`${deviceName} ${portName}`);
-                    if (holder) error(`port ${portName} is given to both ${holder} and ${member.name}`, deviceName);
-                    portHolders.set(`${deviceName} ${portName}`, member.name);
-
-                    const device = devices.find((candidate) => candidate.name === deviceName);
-                    const port = device?.ports?.[portName as keyof typeof device.ports];
-                    const carried = port ? Checks.vlansOf(port) : [];
-
-                    if (carried.length !== 1 || carried[0] !== exchange.vlan) {
-                        error(`port ${portName} of ${member.name} does not carry the peering VLAN alone`, deviceName);
-                    }
-                }
-            });
-
-            return findings;
-        };
-
-        const bird = (server: RouteServer) => RouteServerConfig.bird(server, exchange.lan, members);
-        const openbgpd = (server: RouteServer) => RouteServerConfig.openbgpd(server, exchange.lan, members);
-
-        return { ports, check, bird, openbgpd };
-    }
-}

package/src/helpers/filters.ts

@@ -1,107 +0,0 @@
-import { Address } from "../core/address";
-import type { AclRule, FilterRule, Prefix, TcpFlag } from "../schema";
-
-/** What `Filters.antiAmplification` leaves alone. */
-export type AntiAmplificationOptions = {
-    /** Prefixes inside the destinations whose UDP fragments pass: for a host that receives UDP too large for one packet, such as SIP or some VPNs. Every fragment after the first is dropped when absent. */
-    keep_fragments?: readonly Prefix[];
-};
-
-/** Address lists and edge filters: hardware ACL rules and firewall rules for traffic from outside. */
-export class Filters {
-    /** IPv4 sources that never arrive from the internet: loopback, link-local and "this network", after RFC 6890. */
-    static readonly MARTIANS = ["127.0.0.0/8", "169.254.0.0/16", "0.0.0.0/8"] as const satisfies readonly Prefix[];
-
-    /** IPv4 private space, RFC 1918. */
-    static readonly PRIVATE_RANGES = ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"] as const satisfies readonly Prefix[];
-
-    /** UDP ports of services that answer a small request with a much larger reply, which attackers use to reflect floods at a victim. A reflected flood arrives from these ports. */
-    static readonly AMPLIFIERS = {
-        qotd: 17,
-        chargen: 19,
-        dns: 53,
-        portmap: 111,
-        ntp: 123,
-        netbios: 137,
-        snmp: 161,
-        cldap: 389,
-        slp: 427,
-        rip: 520,
-        "ms-sql": 1434,
-        ssdp: 1900,
-        ard: 3283,
-        "ws-discovery": 3702,
-        mdns: 5353,
-        coap: 5683,
-        ubiquiti: 10001,
-        memcached: 11211,
-        dvr: 37810,
-    } as const satisfies Record<string, number>;
-
-    /** Of the amplifiers, the services hosts do ask across the internet: resolvers, time servers, monitoring. A reply to a real request goes back to the asking port, 1024 or above, or to the service's own port when two servers talk. */
-    private static readonly ASKED: ReadonlySet<number> = new Set([Filters.AMPLIFIERS.dns, Filters.AMPLIFIERS.ntp, Filters.AMPLIFIERS.snmp]);
-
-    /** TCP flag combinations no legitimate packet carries: name, flags set, flags unset. */
-    private static readonly BAD_TCP_FLAGS = [
-        ["FIN+SYN", ["fin", "syn"], []],
-        ["SYN+RST", ["syn", "rst"], []],
-        ["FIN+RST", ["fin", "rst"], []],
-        ["FIN without ACK", ["fin"], ["ack"]],
-        ["FIN+URG", ["fin", "urg"], []],
-        ["Xmas scan", ["fin", "syn", "psh", "urg"], []],
-    ] as const satisfies readonly (readonly [string, readonly TcpFlag[], readonly TcpFlag[]])[];
-
-    /** Hardware ACL rules dropping traffic arriving on a VLAN from sources that cannot be there: your own space, martians, private ranges. One rule per source. */
-    static antiSpoofing<V extends string>(vlan: V, sources: readonly Prefix[]): AclRule<V>[] {
-        return sources.map((src) => ({
-            description: `${vlan}: drop source ${src}`,
-            match: { vlan, src },
-            action: "drop",
-        }));
-    }
-
-    /**
-     * Hardware ACL rules dropping reflected UDP floods toward `destinations`, in the switch chip, without limiting anything else.
-     *
-     * - Replies from an amplifier no host asks across the internet are dropped.
-     * - Replies from DNS, NTP and SNMP are dropped only toward a port below 1024 that is not the service's own. A host that runs its own resolver, time server or monitoring keeps its answers. The service's own port passes first, so every drop takes the one range 0 to 1023: a switch chip has few port-range checkers, and on RouterOS a rule past them is invalid with every rule after it.
-     * - The fragments after the first carry no port, and a switch chip reads them as port 0. They are dropped, but toward `keep_fragments`.
-     */
-    static antiAmplification(destinations: readonly Prefix[], options: AntiAmplificationOptions = {}): AclRule<never>[] {
-        return destinations.flatMap((dst) => [
-            ...(options.keep_fragments ?? [])
-                .filter((prefix) => Address.contains(dst, prefix))
-                .map((prefix): AclRule<never> => ({
-                    description: `UDP fragments to ${prefix} kept`,
-                    match: { protocol: "udp", dst: prefix, src_port: 0 },
-                    action: "accept",
-                })),
-            { description: `UDP fragments to ${dst}`, match: { protocol: "udp", dst, src_port: 0 }, action: "drop" },
-            ...Object.entries(Filters.AMPLIFIERS).flatMap(([name, port]): AclRule<never>[] =>
-                Filters.ASKED.has(port)
-                    ? [
-                          {
-                              description: `UDP to ${dst} from ${name}, between two servers`,
-                              match: { protocol: "udp", dst, src_port: port, dst_port: port },
-                              action: "accept",
-                          },
-                          {
-                              description: `UDP to ${dst} from ${name}, to a port below 1024`,
-                              match: { protocol: "udp", dst, src_port: port, dst_port: { min: 0, max: 1023 } },
-                              action: "drop",
-                          },
-                      ]
-                    : [{ description: `UDP to ${dst} from ${name}`, match: { protocol: "udp", dst, src_port: port }, action: "drop" }]
-            ),
-        ]);
-    }
-
-    /** Firewall rules dropping packets with a TCP flag combination no legitimate packet carries, for a forward chain. */
-    static badTcpFlags(): FilterRule<never, never>[] {
-        return Filters.BAD_TCP_FLAGS.map(([name, set, unset]) => ({
-            description: `Bad flags ${name}`,
-            match: { protocol: "tcp", tcp_flags: { set, unset } },
-            action: "drop",
-        }));
-    }
-}

package/src/helpers/index.ts

@@ -1,25 +0,0 @@
-// Building blocks most networks write the same way: address lists, cables written once for both ends, edge filters, a BGP import sanity policy, an exchange's member ports and route servers, upstreams written once, checks, and helpers for checks of your own. Each returns plain config to place where it belongs, so nothing here applies itself.
-
-export { Bgp } from "./bgp";
-export type {
-    AnnounceOptions,
-    Announced,
-    CommunityScheme,
-    DefaultOnlyOptions,
-    ExportNeighbor,
-    LearnOptions,
-    NeighborCommunities,
-    SanityLengths,
-} from "./bgp";
-export { Cables } from "./cables";
-export type { FarEnd } from "./cables";
-export { Checks } from "./checks";
-export type { TrustBoundary } from "./checks";
-export { Exchange } from "./exchange";
-export type { ExchangeMember, InternetExchange } from "./exchange";
-export { Filters } from "./filters";
-export { RouteServerConfig } from "./route-server";
-export { Upstreams } from "./upstreams";
-export type { NamedVlan, Upstream, UpstreamCatalog, UpstreamOptions, UpstreamPolicy } from "./upstreams";
-export type { RouteServer } from "./route-server";
-export type { AntiAmplificationOptions } from "./filters";

package/src/helpers/route-server.ts

@@ -1,212 +0,0 @@
-import { Address } from "../core/address";
-import type { Family, IPv4, IPv6, Prefix } from "../schema";
-import type { ExchangeMember } from "./exchange";
-
-/** A route server on an exchange's peering LAN: a server running BIRD 2 or OpenBGPD that passes every member's routes to every other member. */
-export type RouteServer = {
-    /** Its name, such as `rs1`, written at the top of its config. */
-    name: string;
-    /** Its own AS. Members peer with it, but it never adds itself to a path, so members see each other's paths as they were sent. */
-    asn: number;
-    /** Its BGP router ID, an IPv4 address of the server. Its address on the peering LAN is the usual pick. */
-    router_id: IPv4;
-    /** Its IPv4 address on the peering LAN. Every member with an IPv4 address gets an IPv4 session from it. */
-    ipv4?: IPv4;
-    /** Its IPv6 address on the peering LAN. Every member with an IPv6 address gets an IPv6 session from it. */
-    ipv6?: IPv6;
-};
-
-/** A route server's config, written from an exchange's member list. Circuit writes the file; it never logs in to the server. */
-export class RouteServerConfig {
-    /** The shortest and longest prefix a member may send, by family. */
-    static readonly LENGTHS: Readonly<Record<Family, { shortest: number; longest: number }>> = {
-        ipv4: { shortest: 8, longest: 24 },
-        ipv6: { shortest: 12, longest: 48 },
-    };
-
-    /** The rules a route must pass, the same in every config. */
-    private static readonly RULES = [
-        "# 1. the first AS in its path is the member's own,",
-        "# 2. its next hop is the member's own address on the peering LAN,",
-        "# 3. it is not inside the peering LAN,",
-        `# 4. it is /${RouteServerConfig.LENGTHS.ipv4.shortest} to /${RouteServerConfig.LENGTHS.ipv4.longest} long for IPv4, /${RouteServerConfig.LENGTHS.ipv6.shortest} to /${RouteServerConfig.LENGTHS.ipv6.longest} for IPv6.`,
-    ];
-
-    /**
-     * The BIRD 2 config of one route server: one session per member and family, each passing on only the routes the member may send.
-     *
-     * Throws when the server has no address on the peering LAN, has one outside it, or two members would get sessions of one name.
-     */
-    static bird(server: RouteServer, lan: { ipv4?: Prefix; ipv6?: Prefix }, members: readonly ExchangeMember[]): string {
-        const families = RouteServerConfig.families(server, lan);
-        const sessions: string[] = [];
-        const names = new Map<string, string>();
-
-        for (const member of members) {
-            for (const family of families) {
-                const neighbor = member[family];
-                if (!neighbor) continue;
-
-                const name = RouteServerConfig.protocolName(member.name, family);
-                const holder = names.get(name);
-                if (holder) throw new Error(`members ${holder} and ${member.name} would both have session ${name}`);
-                names.set(name, member.name);
-
-                sessions.push(RouteServerConfig.birdSession(name, server, member, family, neighbor, lan[family]!));
-            }
-        }
-
-        const header = [
-            `# ${server.name}, a route server of the exchange, for BIRD 2.`,
-            "# Circuit wrote it from the member list: change the list, not this file.",
-            "",
-            `router id ${server.router_id};`,
-            "",
-            "# Learns the server's interfaces and addresses. It sends no route anywhere.",
-            "protocol device {",
-            "}",
-            "",
-            "# One session per member and family. A route a member sends is kept only when:",
-            ...RouteServerConfig.RULES,
-            "# Every member gets every route the others sent, as they sent it.",
-            "# A route that is not kept stays visible: birdc show route filtered.",
-        ];
-
-        return [...header, ...sessions.flatMap((session) => ["", session])].join("\n") + "\n";
-    }
-
-    /**
-     * The OpenBGPD config (`bgpd.conf`) of one route server: one session per member and family, in one group per family, and filter rules that pass on only the routes each member may send.
-     *
-     * Throws when the server has no address on the peering LAN, or has one outside it.
-     */
-    static openbgpd(server: RouteServer, lan: { ipv4?: Prefix; ipv6?: Prefix }, members: readonly ExchangeMember[]): string {
-        const families = RouteServerConfig.families(server, lan).filter((family) => members.some((member) => member[family]));
-
-        const lines = [
-            `# ${server.name}, a route server of the exchange, for OpenBGPD.`,
-            "# Circuit wrote it from the member list: change the list, not this file.",
-            "",
-            `AS ${server.asn}`,
-            `router-id ${server.router_id}`,
-            "",
-            "# The server passes routes on and carries no traffic, so it keeps them out of its own routing table.",
-            "fib-update no",
-            "",
-            "# Members see each other's paths as they were sent: the server never adds its own AS, and passes MED and communities on untouched.",
-            "transparent-as yes",
-            "",
-            "# A route that is not kept stays visible: bgpctl show rib filtered.",
-            "rde rib Loc-RIB include filtered",
-        ];
-
-        for (const family of families) {
-            lines.push("", ...RouteServerConfig.openbgpdGroup(server, family, members));
-        }
-
-        lines.push("", "# A route a member sends is kept only when:", ...RouteServerConfig.RULES);
-        lines.push("# The last rule a route matches decides, and a route no rule allows is dropped.");
-
-        for (const family of families) {
-            const { shortest, longest } = RouteServerConfig.LENGTHS[family];
-            const any = family === "ipv4" ? "0.0.0.0/0" : "::/0";
-
-            // `prefixlen 8-24` without spaces is a syntax error in bgpd 9.1, though its manual shows it.
-            lines.push(
-                `allow from group "${family} members" peer-as neighbor-as nexthop neighbor prefix ${any} prefixlen ${shortest} - ${longest}`
-            );
-        }
-
-        for (const family of families) {
-            lines.push(`deny from any prefix ${Address.prefixOf(lan[family]!)} or-longer`);
-        }
-
-        lines.push("", "# Every member gets every route the others sent, as they sent it.", "allow to any");
-
-        return lines.join("\n") + "\n";
-    }
-
-    /** The families the server has an address in, each checked to be inside the peering LAN. */
-    private static families(server: RouteServer, lan: { ipv4?: Prefix; ipv6?: Prefix }): Family[] {
-        const families = (["ipv4", "ipv6"] as const).filter((family) => server[family]);
-        if (!families.length) throw new Error(`route server ${server.name} has no address on the peering LAN`);
-
-        for (const family of families) {
-            const prefix = lan[family];
-            const address = server[family]!;
-            if (!prefix || !Address.contains(prefix, address))
-                throw new Error(`${address} of route server ${server.name} is outside the peering LAN`);
-        }
-
-        return families;
-    }
-
-    /** A BIRD symbol: letters, digits and underscores, starting with a letter. */
-    private static protocolName(member: string, family: Family): string {
-        const name = `${member.toLowerCase().replace(/[^a-z0-9_]/g, "_")}_${family}`;
-        return /^[a-z]/.test(name) ? name : `m_${name}`;
-    }
-
-    /** A member's name and AS, safe inside double quotes. */
-    private static description(member: ExchangeMember): string {
-        return `"${member.name.replace(/["\\]/g, "")}, AS${member.asn}"`;
-    }
-
-    private static birdSession(
-        name: string,
-        server: RouteServer,
-        member: ExchangeMember,
-        family: Family,
-        neighbor: string,
-        lan: Prefix
-    ): string {
-        const { shortest, longest } = RouteServerConfig.LENGTHS[family];
-
-        return [
-            `protocol bgp ${name} {`,
-            `    description ${RouteServerConfig.description(member)};`,
-            `    local ${server[family]} as ${server.asn};`,
-            `    neighbor ${neighbor} as ${member.asn};`,
-            "    rs client;",
-            `    ${family} {`,
-            "        import keep filtered on;",
-            "        import filter {",
-            `            if bgp_path.first != ${member.asn} then reject;`,
-            `            if bgp_next_hop != ${neighbor} then reject;`,
-            `            if net ~ [ ${Address.prefixOf(lan)}+ ] then reject;`,
-            `            if net.len < ${shortest} || net.len > ${longest} then reject;`,
-            "            accept;",
-            "        };",
-            "        export all;",
-            "    };",
-            "}",
-        ].join("\n");
-    }
-
-    /** One family's sessions: a group holding every member with an address in that family. */
-    private static openbgpdGroup(server: RouteServer, family: Family, members: readonly ExchangeMember[]): string[] {
-        const lines = [
-            `# One session per member with an ${family === "ipv4" ? "IPv4" : "IPv6"} address.`,
-            `group "${family} members" {`,
-            `    local-address ${server[family]}`,
-            "    # A route whose first AS is not the member's own is dropped by the rules below. The default would close the whole session.",
-            "    enforce neighbor-as no",
-        ];
-
-        for (const member of members) {
-            const neighbor = member[family];
-            if (!neighbor) continue;
-
-            lines.push(
-                `    neighbor ${neighbor} {`,
-                `        remote-as ${member.asn}`,
-                `        descr ${RouteServerConfig.description(member)}`,
-                "    }"
-            );
-        }
-
-        lines.push("}");
-
-        return lines;
-    }
-}