ms-split-router 0.1.0__py3-none-any.whl

ms_split_router/config.py

@@ -0,0 +1,611 @@
+"""Generator configuration: YAML file -> validated, frozen dataclasses."""
+
+import ipaddress
+import re
+from collections.abc import Mapping
+from dataclasses import dataclass, field, replace
+from pathlib import Path
+from typing import Any, Literal
+
+import yaml
+
+from .netutil import MAC_RE, IPAddress, IPNetwork, is_valid_domain, normalise_domain, parse_address, parse_network
+
+ID_RE = re.compile(r"^[a-z0-9](?:[a-z0-9-]{0,62})$")
+IFNAME_RE = re.compile(r"^[^\s/]{1,128}$")
+
+DERIVE_SOURCES = ("m365", "m365_additional", "private_dns")
+M365_AREAS = ("Common", "Exchange", "SharePoint", "Skype")
+M365_CATEGORIES = ("Optimize", "Allow", "Default")
+
+type Style = Literal["full", "dropin"]
+type Tristate = Literal["auto"] | bool
+# section -> key -> values (one line per value)
+type ExtraSections = dict[str, dict[str, tuple[str, ...]]]
+
+
+class ConfigError(ValueError):
+    """Invalid configuration; the message names the offending key."""
+
+
+@dataclass(frozen=True, slots=True)
+class Match:
+    mac: str | None = None
+    altname: str | None = None
+    name: str | None = None
+
+    def describe(self) -> str:
+        if self.mac:
+            return f"MAC {self.mac}"
+        return f"altname {self.altname}" if self.altname else f"name {self.name}"
+
+
+@dataclass(frozen=True, slots=True)
+class ResolveOptions:
+    """Per-link systemd-resolved settings written to the ``[Network]`` section."""
+
+    dnssec: str | None = None
+    llmnr: str | None = None
+    multicast_dns: str | None = None
+    dns_over_tls: str | None = None
+
+    def keys(self) -> list[tuple[str, str]]:
+        pairs = [
+            ("DNSSEC", self.dnssec),
+            ("LLMNR", self.llmnr),
+            ("MulticastDNS", self.multicast_dns),
+            ("DNSOverTLS", self.dns_over_tls),
+        ]
+        return [(key, value) for key, value in pairs if value is not None]
+
+
+@dataclass(frozen=True, slots=True)
+class DomainSelection:
+    derive_from: tuple[str, ...] = ("m365", "private_dns")
+    collapse_to_root: bool = True
+    exclude_third_party: bool = True
+    private_dns_clouds: tuple[str, ...] = ("Commercial",)
+    extra: tuple[str, ...] = ()
+    exclude: tuple[str, ...] = ()
+
+
+@dataclass(frozen=True, slots=True)
+class AzureRoutes:
+    clouds: tuple[str, ...] = ("Public",)
+    service_tags: tuple[str, ...] = ("AzureCloud",)
+
+
+@dataclass(frozen=True, slots=True)
+class M365Routes:
+    instances: tuple[str, ...] = ("Worldwide",)
+    service_areas: tuple[str, ...] = ()  # empty = all
+    categories: tuple[str, ...] = ()  # empty = all
+    required_only: bool = False
+    express_route_only: bool = False
+
+
+@dataclass(frozen=True, slots=True)
+class M365AdditionalRoutes:
+    clouds: tuple[str, ...] = ("public",)
+
+
+@dataclass(frozen=True, slots=True)
+class RouteSelection:
+    azure: AzureRoutes | None = field(default_factory=AzureRoutes)
+    m365: M365Routes | None = field(default_factory=M365Routes)
+    m365_additional: M365AdditionalRoutes | None = None
+    extra_prefixes: tuple[IPNetwork, ...] = ()
+    exclude_prefixes: tuple[IPNetwork, ...] = ()
+    ipv6: Tristate = "auto"
+    # Prefixes longer than this are widened to it before collapsing. /48 is the smallest globally routed IPv6 block,
+    # so widening to it never reaches another network's space and keeps AzureCloud's IPv6 within networkd's limits.
+    widen_to_ipv4: int | None = None
+    widen_to_ipv6: int | None = 48
+
+
+@dataclass(frozen=True, slots=True)
+class SplitLink:
+    id: str
+    match: Match | None
+    dns: tuple[str, ...]
+    style: Style = "full"
+    base: str | None = None
+    altname_link: str | None = None
+    gateway4: IPAddress | Literal["auto"] | None = "auto"
+    gateway6: IPAddress | Literal["auto"] | None = "auto"
+    onlink: Tristate = "auto"
+    metric: int | None = None
+    dns_default_route: bool = False
+    required_for_online: str = "no"
+    resolve: ResolveOptions = field(default_factory=ResolveOptions)
+    domains: DomainSelection = field(default_factory=DomainSelection)
+    routes: RouteSelection = field(default_factory=RouteSelection)
+
+
+@dataclass(frozen=True, slots=True)
+class DefaultLink:
+    id: str
+    match: Match | None
+    dns: tuple[str, ...] = ()
+    style: Style = "full"
+    base: str | None = None
+    domains: tuple[str, ...] = ("~.",)
+    dns_default_route: bool = True
+    required_for_online: str = "routable"
+    resolve: ResolveOptions = field(default_factory=ResolveOptions)
+
+
+@dataclass(frozen=True, slots=True)
+class DataConfig:
+    file: Path | None = None
+    fetch_command: str = "ms-cloud-endpoints"
+    fetch_args: tuple[str, ...] = ()
+
+
+@dataclass(frozen=True, slots=True)
+class NetworkdConf:
+    enabled: bool = True
+    manage_foreign_routes: bool = False
+    manage_foreign_routing_policy_rules: bool = False
+    extra: ExtraSections = field(default_factory=dict)
+
+
+@dataclass(frozen=True, slots=True)
+class ResolvedConf:
+    enabled: bool = True
+    dnssec: str | None = "no"
+    extra: ExtraSections = field(default_factory=dict)
+
+
+@dataclass(frozen=True, slots=True)
+class Config:
+    data: DataConfig = field(default_factory=DataConfig)
+    networkd_conf: NetworkdConf = field(default_factory=NetworkdConf)
+    resolved_conf: ResolvedConf = field(default_factory=ResolvedConf)
+    split_links: tuple[SplitLink, ...] = ()
+    default_links: tuple[DefaultLink, ...] = ()
+
+
+# --- parsing helpers --------------------------------------------------------------------------------------------
+
+
+def _fail(path: str, message: str) -> ConfigError:
+    return ConfigError(f"{path}: {message}")
+
+
+def _mapping(value: Any, path: str, allowed: tuple[str, ...]) -> Mapping[str, Any]:
+    if value is None:
+        return {}
+    if not isinstance(value, Mapping):
+        raise _fail(path, f"expected a mapping, got {type(value).__name__}")
+    unknown = sorted(set(value) - set(allowed))
+    if unknown:
+        raise _fail(path, f"unknown key(s) {', '.join(map(str, unknown))}; allowed: {', '.join(allowed)}")
+    return value
+
+
+def _bool(value: Any, path: str) -> bool:
+    if not isinstance(value, bool):
+        raise _fail(path, f"expected true/false, got {value!r}")
+    return value
+
+
+def _str(value: Any, path: str) -> str:
+    if not isinstance(value, str) or not value.strip():
+        raise _fail(path, f"expected a non-empty string, got {value!r}")
+    return value.strip()
+
+
+def _str_list(value: Any, path: str) -> tuple[str, ...]:
+    if value is None:
+        return ()
+    if isinstance(value, str):
+        value = [value]
+    if not isinstance(value, list):
+        raise _fail(path, f"expected a list, got {type(value).__name__}")
+    return tuple(_str(item, f"{path}[{index}]") for index, item in enumerate(value))
+
+
+def _tristate(value: Any, path: str) -> Tristate:
+    if value == "auto" or isinstance(value, bool):
+        return value
+    raise _fail(path, f"expected auto, true or false, got {value!r}")
+
+
+def _systemd_value(value: Any) -> str:
+    """Render a YAML scalar as a systemd setting value (booleans become yes/no)."""
+    if isinstance(value, bool):
+        return "yes" if value else "no"
+    return str(value)
+
+
+def _optional_setting(value: Any, path: str) -> str | None:
+    if value is None:
+        return None
+    if isinstance(value, bool | str | int):
+        return _systemd_value(value)
+    raise _fail(path, f"expected a boolean or string, got {value!r}")
+
+
+def _choices(values: tuple[str, ...], allowed: tuple[str, ...], path: str) -> tuple[str, ...]:
+    lookup = {choice.lower(): choice for choice in allowed}
+    result = []
+    for index, value in enumerate(values):
+        if value.lower() not in lookup:
+            raise _fail(f"{path}[{index}]", f"unknown value {value!r}; allowed: {', '.join(allowed)}")
+        result.append(lookup[value.lower()])
+    return tuple(dict.fromkeys(result))
+
+
+def _networks(value: Any, path: str) -> tuple[IPNetwork, ...]:
+    result = []
+    for index, item in enumerate(_str_list(value, path)):
+        try:
+            network = parse_network(item)
+        except ValueError as exc:
+            raise _fail(f"{path}[{index}]", str(exc)) from None
+        if network.prefixlen == 0:
+            raise _fail(f"{path}[{index}]", f"{network} would replace the default route; refusing")
+        result.append(network)
+    return tuple(result)
+
+
+def _domains(value: Any, path: str) -> tuple[str, ...]:
+    result = []
+    for index, item in enumerate(_str_list(value, path)):
+        domain = normalise_domain(item.removeprefix("~"))
+        if not is_valid_domain(domain):
+            raise _fail(f"{path}[{index}]", f"invalid domain {item!r}")
+        result.append(domain)
+    return tuple(result)
+
+
+def _dns_servers(value: Any, path: str) -> tuple[str, ...]:
+    servers = _str_list(value, path)
+    for index, server in enumerate(servers):
+        # systemd accepts "address[:port][%ifname][#server-name]"; validate the address part.
+        address = server.split("#", 1)[0].split("%", 1)[0]
+        if address.startswith("["):
+            address = address[1:].split("]", 1)[0]
+        elif address.count(":") == 1:
+            address = address.split(":", 1)[0]
+        try:
+            parse_address(address)
+        except ValueError:
+            raise _fail(f"{path}[{index}]", f"invalid DNS server address {server!r}") from None
+    return servers
+
+
+def _extra_sections(value: Any, path: str, default_section: str) -> ExtraSections:
+    if value is None:
+        return {}
+    if not isinstance(value, Mapping):
+        raise _fail(path, "expected a mapping of keys (or of sections to keys)")
+    sections: ExtraSections = {}
+
+    def add(section: str, key: Any, raw: Any, key_path: str) -> None:
+        if not isinstance(key, str) or not re.fullmatch(r"[A-Za-z][A-Za-z0-9]*", key):
+            raise _fail(key_path, f"invalid setting name {key!r}")
+        values = raw if isinstance(raw, list) else [raw]
+        if not all(isinstance(item, bool | str | int | float) for item in values):
+            raise _fail(key_path, "expected a scalar or a list of scalars")
+        sections.setdefault(section, {})[key] = tuple(_systemd_value(item) for item in values)
+
+    for key, raw in value.items():
+        if isinstance(raw, Mapping):
+            for sub_key, sub_raw in raw.items():
+                add(str(key), sub_key, sub_raw, f"{path}.{key}.{sub_key}")
+        else:
+            add(default_section, key, raw, f"{path}.{key}")
+    return sections
+
+
+def _match(value: Any, path: str) -> Match | None:
+    if value is None:
+        return None
+    raw = _mapping(value, path, ("mac", "altname", "name"))
+    present = [key for key in ("mac", "altname", "name") if raw.get(key) is not None]
+    if len(present) != 1:
+        raise _fail(path, "set exactly one of mac, altname or name")
+    key = present[0]
+    text = _str(raw[key], f"{path}.{key}")
+    if key == "mac":
+        text = text.lower().replace("-", ":")
+        if not MAC_RE.match(text):
+            raise _fail(f"{path}.mac", f"invalid MAC address {raw[key]!r}")
+    elif not IFNAME_RE.match(text):
+        raise _fail(f"{path}.{key}", f"invalid interface name {text!r}")
+    return Match(**{key: text})
+
+
+def _gateway(value: Any, path: str) -> IPAddress | Literal["auto"] | None:
+    if value is None or value == "none" or value is False:
+        return None
+    if value == "auto":
+        return "auto"
+    try:
+        return parse_address(_str(value, path))
+    except ValueError:
+        raise _fail(path, f"expected auto, none or an IP address, got {value!r}") from None
+
+
+def _resolve(value: Any, path: str) -> ResolveOptions:
+    raw = _mapping(value, path, ("dnssec", "llmnr", "multicast_dns", "dns_over_tls"))
+    return ResolveOptions(**{key: _optional_setting(raw.get(key), f"{path}.{key}") for key in raw})
+
+
+def _style(raw: Mapping[str, Any], path: str) -> tuple[Style, str | None]:
+    style = raw.get("style", "full")
+    if style not in ("full", "dropin"):
+        raise _fail(f"{path}.style", f"expected full or dropin, got {style!r}")
+    base = raw.get("base")
+    if style == "dropin":
+        base = _str(base, f"{path}.base")
+        if "/" in base or not base.endswith(".network"):
+            raise _fail(f"{path}.base", "expected the file name of a .network file, e.g. 10-eth1.network")
+    elif base is not None:
+        raise _fail(f"{path}.base", "only valid with style: dropin")
+    return style, base
+
+
+def _link_id(raw: Mapping[str, Any], path: str) -> str:
+    link_id = _str(raw.get("id"), f"{path}.id")
+    if not ID_RE.match(link_id):
+        raise _fail(f"{path}.id", f"{link_id!r} must be lower-case letters, digits and '-'")
+    return link_id
+
+
+def _domain_selection(value: Any, path: str) -> DomainSelection:
+    keys = ("derive_from", "collapse_to_root", "exclude_third_party", "private_dns_clouds", "extra", "exclude")
+    raw = _mapping(value, path, keys)
+    default = DomainSelection()
+    derive = raw.get("derive_from", list(default.derive_from))
+    return DomainSelection(
+        derive_from=_choices(_str_list(derive, f"{path}.derive_from"), DERIVE_SOURCES, f"{path}.derive_from"),
+        collapse_to_root=_bool(raw.get("collapse_to_root", default.collapse_to_root), f"{path}.collapse_to_root"),
+        exclude_third_party=_bool(
+            raw.get("exclude_third_party", default.exclude_third_party), f"{path}.exclude_third_party"
+        ),
+        private_dns_clouds=_str_list(raw.get("private_dns_clouds", ["Commercial"]), f"{path}.private_dns_clouds"),
+        extra=_domains(raw.get("extra"), f"{path}.extra"),
+        exclude=_domains(raw.get("exclude"), f"{path}.exclude"),
+    )
+
+
+def _routes(value: Any, path: str) -> RouteSelection:
+    raw = _mapping(
+        value, path, ("azure", "m365", "m365_additional", "extra_prefixes", "exclude_prefixes", "ipv6", "widen_to")
+    )
+
+    azure: AzureRoutes | None = AzureRoutes()
+    if "azure" in raw:
+        if raw["azure"] in (None, False):
+            azure = None
+        else:
+            sub = _mapping(raw["azure"], f"{path}.azure", ("clouds", "service_tags"))
+            azure = AzureRoutes(
+                clouds=_str_list(sub.get("clouds", ["Public"]), f"{path}.azure.clouds"),
+                service_tags=_str_list(sub.get("service_tags", ["AzureCloud"]), f"{path}.azure.service_tags"),
+            )
+            if not azure.service_tags:
+                azure = None
+
+    m365: M365Routes | None = M365Routes()
+    if "m365" in raw:
+        if raw["m365"] in (None, False):
+            m365 = None
+        else:
+            sub_path = f"{path}.m365"
+            sub = _mapping(
+                raw["m365"],
+                sub_path,
+                ("instances", "service_areas", "categories", "required_only", "express_route_only"),
+            )
+            m365 = M365Routes(
+                instances=_str_list(sub.get("instances", ["Worldwide"]), f"{sub_path}.instances"),
+                service_areas=_choices(
+                    _str_list(sub.get("service_areas"), f"{sub_path}.service_areas"),
+                    M365_AREAS,
+                    f"{sub_path}.service_areas",
+                ),
+                categories=_choices(
+                    _str_list(sub.get("categories"), f"{sub_path}.categories"),
+                    M365_CATEGORIES,
+                    f"{sub_path}.categories",
+                ),
+                required_only=_bool(sub.get("required_only", False), f"{sub_path}.required_only"),
+                express_route_only=_bool(sub.get("express_route_only", False), f"{sub_path}.express_route_only"),
+            )
+
+    m365_additional: M365AdditionalRoutes | None = None
+    additional = raw.get("m365_additional")
+    if additional is True:
+        m365_additional = M365AdditionalRoutes()
+    elif isinstance(additional, Mapping):
+        sub = _mapping(additional, f"{path}.m365_additional", ("clouds",))
+        clouds = _str_list(sub.get("clouds", ["public"]), f"{path}.m365_additional.clouds")
+        m365_additional = M365AdditionalRoutes(
+            clouds=_choices(clouds, ("public", "usgov", "china"), f"{path}.m365_additional.clouds")
+        )
+    elif additional not in (None, False):
+        raise _fail(f"{path}.m365_additional", "expected true, false or a mapping")
+
+    widen = _mapping(raw.get("widen_to"), f"{path}.widen_to", ("ipv4", "ipv6"))
+    widen_to: dict[str, int | None] = {"ipv4": None, "ipv6": 48}
+    for family, (low, high) in (("ipv4", (8, 32)), ("ipv6", (16, 128))):
+        if family in widen:
+            length = widen[family]
+            if length is not None and (not isinstance(length, int) or isinstance(length, bool)
+                                       or not low <= length <= high):  # fmt: skip
+                raise _fail(f"{path}.widen_to.{family}", f"expected null or a prefix length {low}-{high}")
+            widen_to[family] = length
+
+    return RouteSelection(
+        azure=azure,
+        m365=m365,
+        m365_additional=m365_additional,
+        extra_prefixes=_networks(raw.get("extra_prefixes"), f"{path}.extra_prefixes"),
+        exclude_prefixes=_networks(raw.get("exclude_prefixes"), f"{path}.exclude_prefixes"),
+        ipv6=_tristate(raw.get("ipv6", "auto"), f"{path}.ipv6"),
+        widen_to_ipv4=widen_to["ipv4"],
+        widen_to_ipv6=widen_to["ipv6"],
+    )
+
+
+def _split_link(value: Any, path: str) -> SplitLink:
+    keys = (
+        "id", "match", "altname_link", "style", "base", "gateway4", "gateway6", "onlink", "metric", "dns",
+        "dns_default_route", "required_for_online", "resolve", "domains", "routes",
+    )  # fmt: skip
+    raw = _mapping(value, path, keys)
+    link_id = _link_id(raw, path)
+    style, base = _style(raw, path)
+    match = _match(raw.get("match"), f"{path}.match")
+    gateway4 = _gateway(raw.get("gateway4", "auto"), f"{path}.gateway4")
+    gateway6 = _gateway(raw.get("gateway6", "auto"), f"{path}.gateway6")
+    for name, gateway in (("gateway4", gateway4), ("gateway6", gateway6)):
+        expected = 4 if name == "gateway4" else 6
+        if isinstance(gateway, ipaddress.IPv4Address | ipaddress.IPv6Address) and gateway.version != expected:
+            raise _fail(f"{path}.{name}", f"expected an IPv{expected} address")
+    needs_discovery = "auto" in (gateway4, gateway6) or raw.get("onlink", "auto") == "auto"
+    if match is None and (style == "full" or needs_discovery):
+        raise _fail(f"{path}.match", "required for style: full and for gateway/onlink auto-detection")
+
+    altname_link = None
+    if raw.get("altname_link") is not None:
+        sub = _mapping(raw["altname_link"], f"{path}.altname_link", ("name",))
+        altname_link = _str(sub.get("name"), f"{path}.altname_link.name")
+        if not IFNAME_RE.match(altname_link):
+            raise _fail(f"{path}.altname_link.name", f"invalid interface name {altname_link!r}")
+        if match is None or match.mac is None:
+            raise _fail(f"{path}.altname_link", "requires match.mac (the .link file matches on the MAC address)")
+
+    metric = raw.get("metric")
+    if metric is not None and (not isinstance(metric, int) or isinstance(metric, bool) or metric < 0):
+        raise _fail(f"{path}.metric", f"expected a non-negative integer, got {metric!r}")
+
+    return SplitLink(
+        id=link_id,
+        match=match,
+        dns=_dns_servers(raw.get("dns"), f"{path}.dns"),
+        style=style,
+        base=base,
+        altname_link=altname_link,
+        gateway4=gateway4,
+        gateway6=gateway6,
+        onlink=_tristate(raw.get("onlink", "auto"), f"{path}.onlink"),
+        metric=metric,
+        dns_default_route=_bool(raw.get("dns_default_route", False), f"{path}.dns_default_route"),
+        required_for_online=_systemd_value(raw.get("required_for_online", "no")),
+        resolve=_resolve(raw.get("resolve"), f"{path}.resolve"),
+        domains=_domain_selection(raw.get("domains"), f"{path}.domains"),
+        routes=_routes(raw.get("routes"), f"{path}.routes"),
+    )
+
+
+def _default_link(value: Any, path: str) -> DefaultLink:
+    keys = ("id", "match", "style", "base", "dns", "domains", "dns_default_route", "required_for_online", "resolve")
+    raw = _mapping(value, path, keys)
+    style, base = _style(raw, path)
+    match = _match(raw.get("match"), f"{path}.match")
+    if match is None and style == "full":
+        raise _fail(f"{path}.match", "required for style: full")
+    domains = []
+    for index, item in enumerate(_str_list(raw.get("domains", ["~."]), f"{path}.domains")):
+        routing_only = item.startswith("~")
+        domain = normalise_domain(item.removeprefix("~"))
+        if domain in ("", "."):
+            if not routing_only:
+                raise _fail(f"{path}.domains[{index}]", "the catch-all domain must be written ~.")
+            domains.append("~.")
+            continue
+        if not is_valid_domain(domain):
+            raise _fail(f"{path}.domains[{index}]", f"invalid domain {item!r}")
+        domains.append(("~" if routing_only else "") + domain)
+    return DefaultLink(
+        id=_link_id(raw, path),
+        match=match,
+        dns=_dns_servers(raw.get("dns"), f"{path}.dns"),
+        style=style,
+        base=base,
+        domains=tuple(domains),
+        dns_default_route=_bool(raw.get("dns_default_route", True), f"{path}.dns_default_route"),
+        required_for_online=_systemd_value(raw.get("required_for_online", "routable")),
+        resolve=_resolve(raw.get("resolve"), f"{path}.resolve"),
+    )
+
+
+def parse_config(raw: Any, base_dir: Path | None = None) -> Config:
+    """Validate a parsed YAML document. Relative ``data.file`` paths are resolved against ``base_dir``."""
+    top = _mapping(raw, "config", ("data", "networkd_conf", "resolved_conf", "split_links", "default_links"))
+
+    data_raw = _mapping(top.get("data"), "data", ("file", "fetch"))
+    fetch_raw = _mapping(data_raw.get("fetch"), "data.fetch", ("command", "args"))
+    file = None
+    if data_raw.get("file") is not None:
+        file = Path(_str(data_raw["file"], "data.file")).expanduser()
+        if base_dir is not None and not file.is_absolute():
+            file = base_dir / file
+    data = DataConfig(
+        file=file,
+        fetch_command=_str(fetch_raw.get("command", "ms-cloud-endpoints"), "data.fetch.command"),
+        fetch_args=_str_list(fetch_raw.get("args"), "data.fetch.args"),
+    )
+
+    nd_raw = _mapping(
+        top.get("networkd_conf"),
+        "networkd_conf",
+        ("enabled", "manage_foreign_routes", "manage_foreign_routing_policy_rules", "extra"),
+    )
+    networkd_conf = NetworkdConf(
+        enabled=_bool(nd_raw.get("enabled", True), "networkd_conf.enabled"),
+        manage_foreign_routes=_bool(nd_raw.get("manage_foreign_routes", False), "networkd_conf.manage_foreign_routes"),
+        manage_foreign_routing_policy_rules=_bool(
+            nd_raw.get("manage_foreign_routing_policy_rules", False),
+            "networkd_conf.manage_foreign_routing_policy_rules",
+        ),
+        extra=_extra_sections(nd_raw.get("extra"), "networkd_conf.extra", "Network"),
+    )
+
+    rc_raw = _mapping(top.get("resolved_conf"), "resolved_conf", ("enabled", "dnssec", "extra"))
+    resolved_conf = ResolvedConf(
+        enabled=_bool(rc_raw.get("enabled", True), "resolved_conf.enabled"),
+        dnssec=_optional_setting(rc_raw.get("dnssec", False), "resolved_conf.dnssec"),
+        extra=_extra_sections(rc_raw.get("extra"), "resolved_conf.extra", "Resolve"),
+    )
+
+    split_raw = top.get("split_links") or []
+    default_raw = top.get("default_links") or []
+    for key, value in (("split_links", split_raw), ("default_links", default_raw)):
+        if not isinstance(value, list):
+            raise _fail(key, "expected a list")
+    split_links = tuple(_split_link(item, f"split_links[{index}]") for index, item in enumerate(split_raw))
+    default_links = tuple(_default_link(item, f"default_links[{index}]") for index, item in enumerate(default_raw))
+    if not split_links:
+        raise _fail("split_links", "at least one split link is required")
+
+    ids = [link.id for link in (*split_links, *default_links)]
+    duplicates = sorted({link_id for link_id in ids if ids.count(link_id) > 1})
+    if duplicates:
+        raise _fail("config", f"duplicate link id(s): {', '.join(duplicates)}")
+    bases = [link.base for link in (*split_links, *default_links) if link.base]
+    if len(bases) != len(set(bases)):
+        raise _fail("config", "two links use style: dropin with the same base file")
+
+    return Config(data, networkd_conf, resolved_conf, split_links, default_links)
+
+
+def load_config(path: Path) -> Config:
+    try:
+        raw = yaml.safe_load(path.read_text(encoding="utf-8"))
+    except OSError as exc:
+        raise ConfigError(f"cannot read {path}: {exc.strerror or exc}") from None
+    except yaml.YAMLError as exc:
+        raise ConfigError(f"{path}: invalid YAML: {exc}") from None
+    return parse_config(raw, path.parent)
+
+
+def with_ipv6(config: Config, ipv6: Tristate) -> Config:
+    """Return ``config`` with ``routes.ipv6`` replaced on every split link (``--ipv6`` / ``--no-ipv6``)."""
+    links = tuple(replace(link, routes=replace(link.routes, ipv6=ipv6)) for link in config.split_links)
+    return replace(config, split_links=links)