@takodotid/circuit 0.8.0 → 0.9.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.8.0",
+    "version": "0.9.0",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",

package/src/adapters/devices/routeros/TRAPS.md

@@ -31,3 +31,5 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - `:find` on an array returns a number or `nil`. Globals persist between exec commands of one login.
 - A fixed port speed is named by medium, `speed=10G-baseSR-LR` for an optic or `speed=1G-baseT-full` for copper, and only holds with `auto-negotiation=no`. With auto-negotiation back on, the export no longer prints the speed, so the plan resets only auto-negotiation. `speed=""` is refused as ambiguous and `unset speed` does not exist.
 - `bgp-path-len` counts every AS in the path, prepends included, and takes the same strict comparisons as `dst-len`.
+- `:parse` checks the command, not the text inside `rule=`. A routing filter rule is only checked when it is added.
+- `/routing/filter/filter-wizard` adds the rule it builds; it is not a dry run. `set blackhole yes` was proved this way on 7.23, in an unused chain removed right after.

package/src/adapters/devices/routeros/render.ts

@@ -1006,6 +1006,7 @@ function actions(rule: AnyRule, family: Family): string[] {
     // An address only means something to routes of its own family.
     if (set.next_hop && familyOf(set.next_hop) === family) steps.push(`set gw ${set.next_hop}`);
     if (set.preferred_source && familyOf(set.preferred_source) === family) steps.push(`set pref-src ${set.preferred_source}`);
+    if (set.blackhole) steps.push("set blackhole yes");
     if (rule.action) steps.push(rule.action);
     return steps;
 }

package/src/presets/index.ts

@@ -223,6 +223,8 @@ export type CommunityScheme<Class extends string = string> = {
     do_not_announce?: number;
     /** Set by a customer: prepend toward an AS once, twice or three times, `asn:function:asn`. */
     prepend?: { once?: number; twice?: number; three_times?: number };
+    /** Set by a customer: drop traffic to the route in your network, before it reaches them, `asn:function:0`. The route is never announced further. */
+    blackhole?: number;
 };
 
 const PREPENDS = [
@@ -238,6 +240,7 @@ const article = (word: string) => (/^[aeiou]/i.test(word) ? `an ${word}` : `a ${
  *
  * - `tag(neighborClass, neighborAs, { site, keepActions })`: a rule for an import policy. It removes your communities a neighbor set, then adds where the route was learned. `site` is needed when the scheme has `learned_at`. With `keepActions`, for a customer, its action communities stay.
  * - `actions(neighborAs)`: rules for an export policy toward one neighbor. They act on a customer's action communities, then remove all of yours. Place them before the rules that accept.
+ * - `blackhole(prefixSet)`: a rule for a customer's import policy, before anything that rejects long prefixes. It takes a route the customer asked to blackhole, but only inside `prefixSet`, its own space, and drops traffic to it here.
  * - `catalogue`: every community, for `communities` in `defineNetwork`.
  */
 export function communityScheme<const Class extends string>(scheme: CommunityScheme<Class>) {
@@ -272,7 +275,27 @@ export function communityScheme<const Class extends string>(scheme: CommunitySch
         };
     };
 
+    const blackhole = <S extends string>(prefixSet: S): PolicyRule<never, S> => {
+        if (scheme.blackhole === undefined) throw new Error("communityScheme: blackhole needs a function number in the scheme");
+
+        return {
+            description: "Blackhole, asked by the customer",
+            match: { large_community: community(scheme.blackhole, 0), prefix_set: prefixSet },
+            set: { blackhole: true },
+            action: "accept",
+        };
+    };
+
     const actions = (neighborAs: number): PolicyRule<never, never>[] => [
+        ...(scheme.blackhole !== undefined
+            ? [
+                  {
+                      description: "Blackholed here, never announced",
+                      match: { large_community: community(scheme.blackhole, 0) },
+                      action: "reject" as const,
+                  },
+              ]
+            : []),
         ...(scheme.do_not_announce !== undefined
             ? [
                   {
@@ -332,7 +355,10 @@ export function communityScheme<const Class extends string>(scheme: CommunitySch
             const fn = scheme.prepend?.[name];
             return fn === undefined ? [] : [{ community: community(fn, "nnn"), description: `Prepend ${name.replace("_", " ")} to AS$0` }];
         }),
+        ...(scheme.blackhole !== undefined
+            ? [{ community: community(scheme.blackhole, 0), description: `Blackhole: dropped in AS${asn}, not announced further` }]
+            : []),
     ];
 
-    return { community, tag, actions, catalogue };
+    return { community, tag, actions, blackhole, catalogue };
 }

package/src/schema/policy.ts

@@ -64,6 +64,8 @@ export type Sets = {
     next_hop?: IP;
     /** Source address for traffic the device itself sends to the route. Applies to routes of the same family as the address. */
     preferred_source?: IP;
+    /** Drop traffic to the route on this device, instead of forwarding it. */
+    blackhole?: true;
 };
 
 /**