ms-split-router 0.1.0__py3-none-any.whl

ms_split_router/generate.py

@@ -0,0 +1,200 @@
+"""Combine configuration, collector data and link discovery into the set of files to write."""
+
+import logging
+from dataclasses import dataclass, field
+from typing import Any
+
+from .config import Config, SplitLink
+from .data import collected_ipv6, data_versions
+from .discover import Discovery, DiscoveryError, Gateway
+from .domains import derive_domains
+from .netutil import IPAddress, IPNetwork
+from .render import (
+    RenderedFile,
+    gateway_conflicts,
+    render_altname_link,
+    render_default_network,
+    render_networkd_conf,
+    render_resolved_conf,
+    render_split_network,
+    route_specs,
+)
+from .select import select_prefixes
+
+log = logging.getLogger(__name__)
+
+# systemd-networkd ignores [Route] sections beyond this per .network file, including its drop-ins
+# (STATIC_ROUTES_PER_NETWORK_MAX; it logs "Failed to allocate route ... Argument list too long").
+NETWORKD_MAX_ROUTES = 8192
+
+
+class GenerateError(RuntimeError):
+    """The configuration cannot be rendered (for example a gateway is missing)."""
+
+
+@dataclass(slots=True)
+class LinkSummary:
+    id: str
+    ipv4_routes: int
+    ipv6_routes: int
+    domains: list[str]
+    gateway4: str | None
+    gateway6: str | None
+    dropped_third_party: list[str] = field(default_factory=list)
+
+
+@dataclass(slots=True)
+class Generated:
+    files: list[RenderedFile]
+    links: list[LinkSummary]
+
+
+def _resolve_gateway(link: SplitLink, version: int, discovery: Discovery) -> tuple[IPAddress | None, Gateway | None]:
+    """Return the configured or detected gateway, plus the detected route (if discovery ran)."""
+    configured = link.gateway4 if version == 4 else link.gateway6
+    detected: Gateway | None = None
+    if (configured == "auto" or link.onlink == "auto") and link.match is not None:
+        try:
+            info = discovery.info(link.match)
+        except DiscoveryError as exc:
+            if configured == "auto":
+                raise GenerateError(f"{link.id}: cannot auto-detect gateway{version}: {exc}") from None
+            log.warning("%s: %s; assuming the gateway is not on-link", link.id, exc)
+        else:
+            detected = info.gateway4 if version == 4 else info.gateway6
+    if configured == "auto":
+        return (detected.address if detected else None), detected
+    return configured, detected  # type: ignore[return-value]
+
+
+def _onlink(link: SplitLink, gateway: IPAddress, detected: Gateway | None) -> bool:
+    if link.onlink != "auto":
+        return bool(link.onlink)
+    return detected is not None and detected.address == gateway and detected.onlink
+
+
+def _split_link_files(link: SplitLink, document: dict[str, Any], discovery: Discovery, versions: list[str]):
+    prefixes = select_prefixes(document, link.routes, link.id)
+
+    gateway4, detected4 = _resolve_gateway(link, 4, discovery)
+    gateway6, detected6 = _resolve_gateway(link, 6, discovery)
+    if gateway4 is None and link.gateway4 == "auto":
+        raise GenerateError(
+            f"{link.id}: no IPv4 default route found on the link; set gateway4 explicitly (or gateway4: none)"
+        )
+
+    routes = []
+    if gateway4 is not None:
+        routes += route_specs(prefixes.ipv4, gateway4, _onlink(link, gateway4, detected4), link.metric)
+    elif prefixes.ipv4:
+        log.warning("%s: gateway4 is none; skipping %d IPv4 prefixes", link.id, len(prefixes.ipv4))
+
+    ipv6_wanted = link.routes.ipv6
+    ipv6_in_data = collected_ipv6(document)
+    if ipv6_wanted is True:
+        required = f"{link.id}: IPv6 routes are required (routes.ipv6: true or --ipv6)"
+        if gateway6 is None:
+            raise GenerateError(f"{required} but no IPv6 gateway is configured or detected")
+        if not ipv6_in_data:
+            raise GenerateError(f"{required} but the collector data was gathered with --no-ipv6")
+    if ipv6_wanted is not False and gateway6 is not None:
+        if not ipv6_in_data:
+            log.info("%s: no Microsoft IPv6 routes: the collector data was gathered with --no-ipv6", link.id)
+        routes += route_specs(prefixes.ipv6, gateway6, _onlink(link, gateway6, detected6), link.metric)
+    elif prefixes.ipv6:
+        reason = "routes.ipv6: false or --no-ipv6" if ipv6_wanted is False else "the link has no IPv6 gateway"
+        log.info("%s: skipping %d IPv6 prefixes (%s)", link.id, len(prefixes.ipv6), reason)
+
+    for gateway in (gateway4, gateway6):
+        conflicts = gateway_conflicts((route.destination for route in routes), gateway)
+        if conflicts:
+            log.warning(
+                "%s: prefix(es) %s contain the gateway %s; consider routes.exclude_prefixes",
+                link.id,
+                ", ".join(map(str, conflicts)),
+                gateway,
+            )
+
+    domain_result = derive_domains(document, link)
+    domains = domain_result.domains
+    if not link.dns:
+        log.warning("%s: no dns servers configured; the DNS layer (Domains=) is not generated", link.id)
+        domains = []
+    elif not domains:
+        log.warning("%s: no routing domains selected; the split link will receive no DNS queries", link.id)
+
+    ipv4_count = sum(1 for route in routes if route.destination.version == 4)
+    ipv6_count = len(routes) - ipv4_count
+    if len(routes) > NETWORKD_MAX_ROUTES:
+        raise GenerateError(
+            f"{link.id}: {len(routes)} routes ({ipv4_count} IPv4, {ipv6_count} IPv6) exceed the "
+            f"{NETWORKD_MAX_ROUTES} static routes systemd-networkd accepts per .network file; the rest would be "
+            "silently ignored. Lower routes.widen_to, narrow routes.azure.service_tags or set routes.ipv6: false "
+            "(or --no-ipv6)"
+        )
+    details = [
+        *versions,
+        f"{ipv4_count} IPv4 and {ipv6_count} IPv6 routes (from {prefixes.input_count} prefixes), "
+        f"{len(domains)} routing domains",
+    ]
+    files = [render_split_network(link, link.dns, domains, routes, details)]
+    if link.altname_link:
+        files.append(render_altname_link(link))
+    summary = LinkSummary(
+        id=link.id,
+        ipv4_routes=ipv4_count,
+        ipv6_routes=ipv6_count,
+        domains=domains,
+        gateway4=str(gateway4) if gateway4 and ipv4_count else None,
+        gateway6=str(gateway6) if gateway6 and ipv6_count else None,
+        dropped_third_party=domain_result.dropped_third_party,
+    )
+    routed: set[IPNetwork] = {route.destination for route in routes}
+    return files, summary, routed
+
+
+def _log_overlaps(summaries: list[LinkSummary], routed: dict[str, set[IPNetwork]]) -> None:
+    for index, first in enumerate(summaries):
+        for second in summaries[index + 1 :]:
+            shared_prefixes = routed[first.id] & routed[second.id]
+            shared_domains = set(first.domains) & set(second.domains)
+            if shared_prefixes or shared_domains:
+                log.info(
+                    "Links %s and %s share %d prefixes and %d domains; the kernel (metric) and resolved (both "
+                    "links queried) break the ties",
+                    first.id,
+                    second.id,
+                    len(shared_prefixes),
+                    len(shared_domains),
+                )
+
+
+def generate(config: Config, document: dict[str, Any], discovery: Discovery | None = None) -> Generated:
+    discovery = discovery or Discovery()
+    versions = data_versions(document)
+    files: list[RenderedFile] = []
+    summaries: list[LinkSummary] = []
+    routed: dict[str, set[IPNetwork]] = {}
+
+    for link in config.split_links:
+        link_files, summary, link_routes = _split_link_files(link, document, discovery, versions)
+        files += link_files
+        summaries.append(summary)
+        routed[link.id] = link_routes
+    _log_overlaps(summaries, routed)
+
+    for default_link in config.default_links:
+        if not default_link.dns:
+            log.warning("%s: default link has no dns servers; its Domains= will not resolve anything", default_link.id)
+        files.append(render_default_network(default_link))
+
+    if config.networkd_conf.enabled:
+        files.append(render_networkd_conf(config.networkd_conf))
+    if config.resolved_conf.enabled and (resolved := render_resolved_conf(config.resolved_conf)) is not None:
+        files.append(resolved)
+
+    paths = [file.path for file in files]
+    duplicates = sorted({path for path in paths if paths.count(path) > 1})
+    if duplicates:
+        raise GenerateError(f"two links render the same file: {', '.join(duplicates)}")
+    return Generated(files=files, links=summaries)

ms_split_router/install.py

@@ -0,0 +1,163 @@
+"""Compare rendered files with a target tree, write changes atomically, prune stale files and reload services."""
+
+import difflib
+import logging
+import os
+import subprocess
+import tempfile
+from collections.abc import Callable, Iterable, Sequence
+from dataclasses import dataclass
+from pathlib import Path
+
+from .config import Config
+from .render import MARKER, NETWORK_DIR, NETWORKD_CONF_PATH, RESOLVED_CONF_PATH, Kind, RenderedFile
+
+log = logging.getLogger(__name__)
+
+type CommandRunner = Callable[[Sequence[str]], int]
+
+
+@dataclass(frozen=True, slots=True)
+class Change:
+    path: str
+    kind: Kind
+    old: str | None  # None: the file does not exist yet
+    new: str | None  # None: the file is removed (prune)
+
+    @property
+    def action(self) -> str:
+        if self.new is None:
+            return "remove"
+        return "create" if self.old is None else "update"
+
+
+def _read(path: Path) -> str | None:
+    try:
+        return path.read_text(encoding="utf-8")
+    except (FileNotFoundError, NotADirectoryError):
+        return None
+
+
+def _kind_of(relative: str) -> Kind:
+    if relative.startswith(NETWORKD_CONF_PATH.rsplit("/", 1)[0]):
+        return "networkd_conf"
+    if relative.startswith(RESOLVED_CONF_PATH.rsplit("/", 1)[0]):
+        return "resolved_conf"
+    return "link" if relative.endswith(".link") else "network"
+
+
+def generated_files_in(root: Path) -> list[str]:
+    """Relative paths of files under ``root`` that carry this generator's marker."""
+    patterns = [
+        f"{NETWORK_DIR}/*.network",
+        f"{NETWORK_DIR}/*.link",
+        f"{NETWORK_DIR}/*.network.d/*.conf",
+        f"{NETWORKD_CONF_PATH.rsplit('/', 1)[0]}/*.conf",
+        f"{RESOLVED_CONF_PATH.rsplit('/', 1)[0]}/*.conf",
+    ]
+    found = []
+    for pattern in patterns:
+        for path in root.glob(pattern):
+            try:
+                with path.open(encoding="utf-8") as stream:
+                    first_line = stream.readline()
+            except (OSError, UnicodeDecodeError):
+                continue
+            if first_line.startswith(MARKER):
+                found.append(path.relative_to(root).as_posix())
+    return sorted(found)
+
+
+def plan_changes(files: Iterable[RenderedFile], root: Path, *, prune: bool = False) -> list[Change]:
+    changes = []
+    rendered = {file.path: file for file in files}
+    for path, file in sorted(rendered.items()):
+        old = _read(root / path)
+        if old != file.content:
+            changes.append(Change(path, file.kind, old, file.content))
+    if prune:
+        for path in generated_files_in(root):
+            if path not in rendered:
+                changes.append(Change(path, _kind_of(path), _read(root / path), None))
+    return changes
+
+
+def diff(changes: Iterable[Change], root: Path) -> str:
+    chunks = []
+    for change in changes:
+        target = (root / change.path).as_posix()
+        chunks.extend(
+            difflib.unified_diff(
+                (change.old or "").splitlines(keepends=True),
+                (change.new or "").splitlines(keepends=True),
+                fromfile=target if change.old is not None else "/dev/null",
+                tofile=target if change.new is not None else "/dev/null",
+            )
+        )
+    return "".join(chunks)
+
+
+def _atomic_write(path: Path, content: str) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True, mode=0o755)
+    fd, temp = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as stream:
+            stream.write(content)
+        os.chmod(temp, 0o644)
+        os.replace(temp, path)
+    except BaseException:
+        Path(temp).unlink(missing_ok=True)
+        raise
+
+
+def apply_changes(changes: Iterable[Change], root: Path) -> None:
+    for change in changes:
+        path = root / change.path
+        if change.new is None:
+            path.unlink(missing_ok=True)
+            if path.parent.name.endswith(".network.d") and not any(path.parent.iterdir()):
+                path.parent.rmdir()
+        else:
+            _atomic_write(path, change.new)
+        log.info("%s %s", change.action, path)
+
+
+def reload_commands(changes: Sequence[Change], config: Config) -> list[list[str]]:
+    """Service actions that make systemd pick up ``changes``, in the order they must run."""
+    kinds = {change.kind for change in changes}
+    commands: list[list[str]] = []
+    if "link" in kinds:
+        commands.append(["udevadm", "control", "--reload"])
+        # .link settings (AlternativeName=) are only applied on "add" uevents.
+        for link in config.split_links:
+            if link.altname_link and link.match and link.match.mac:
+                commands.append(
+                    ["udevadm", "trigger", "--action=add", "--subsystem-match=net",
+                     f"--attr-match=address={link.match.mac}"]
+                )  # fmt: skip
+        commands.append(["udevadm", "settle"])
+    if "networkd_conf" in kinds:
+        commands.append(["systemctl", "restart", "systemd-networkd"])
+    elif kinds & {"network", "link"}:
+        commands.append(["networkctl", "reload"])
+    if "resolved_conf" in kinds:
+        commands.append(["systemctl", "try-reload-or-restart", "systemd-resolved"])
+    return commands
+
+
+def run_command(command: Sequence[str]) -> int:
+    try:
+        return subprocess.run(command, check=False).returncode
+    except FileNotFoundError:
+        log.error("%s: command not found", command[0])
+        return 127
+
+
+def run_commands(commands: Iterable[Sequence[str]], runner: CommandRunner = run_command) -> list[str]:
+    """Run each command; return the ones that failed."""
+    failed = []
+    for command in commands:
+        log.info("running %s", " ".join(command))
+        if runner(command) != 0:
+            failed.append(" ".join(command))
+    return failed

ms_split_router/netutil.py

@@ -0,0 +1,105 @@
+"""IP prefix and domain helpers.
+
+Partly duplicated from ``ms_cloud_endpoints.netutil`` on purpose: this package only reads the collector's output and
+does not depend on it.
+"""
+
+import ipaddress
+import re
+from collections.abc import Iterable
+
+type IPNetwork = ipaddress.IPv4Network | ipaddress.IPv6Network
+type IPAddress = ipaddress.IPv4Address | ipaddress.IPv6Address
+
+PLACEHOLDER_RE = re.compile(r"\{[A-Za-z]+\}")
+# A routing domain as accepted by systemd: dot-separated LDH labels (underscore tolerated), no wildcards.
+DOMAIN_RE = re.compile(
+    r"^(?=.{1,253}$)(?:[a-z0-9_](?:[a-z0-9_-]{0,61}[a-z0-9_])?)(?:\.[a-z0-9_](?:[a-z0-9_-]{0,61}[a-z0-9_])?)*$"
+)
+MAC_RE = re.compile(r"^[0-9a-f]{2}(?::[0-9a-f]{2}){5}$")
+
+# Public suffixes with more than one label that occur in Microsoft endpoint lists; see ms_cloud_endpoints.netutil.
+MULTI_LABEL_SUFFIXES = frozenset(
+    {
+        "co.uk", "org.uk", "gov.uk", "ac.uk", "com.cn", "net.cn", "gov.cn", "org.cn", "com.au", "net.au",
+        "co.jp", "ne.jp", "co.kr", "co.in", "co.nz", "com.br", "com.mx", "com.tw", "com.hk", "com.sg",
+        "co.za", "us.com",
+    }
+)  # fmt: skip
+
+
+def parse_network(value: str) -> IPNetwork:
+    """Parse a prefix (host bits are cleared); raises ``ValueError`` for invalid input."""
+    return ipaddress.ip_network(str(value).strip(), strict=False)
+
+
+def parse_address(value: str) -> IPAddress:
+    return ipaddress.ip_address(str(value).strip())
+
+
+def collapse(networks: Iterable[IPNetwork]) -> tuple[list[ipaddress.IPv4Network], list[ipaddress.IPv6Network]]:
+    """Collapse overlapping/adjacent prefixes, returning sorted IPv4 and IPv6 lists."""
+    ipv4: list[ipaddress.IPv4Network] = []
+    ipv6: list[ipaddress.IPv6Network] = []
+    for network in networks:
+        if isinstance(network, ipaddress.IPv4Network):
+            ipv4.append(network)
+        else:
+            ipv6.append(network)
+    return list(ipaddress.collapse_addresses(ipv4)), list(ipaddress.collapse_addresses(ipv6))
+
+
+def subtract(networks: Iterable[IPNetwork], excludes: Iterable[IPNetwork]) -> list[IPNetwork]:
+    """Remove every address in ``excludes`` from ``networks``, splitting prefixes where needed."""
+    result = list(networks)
+    for exclude in excludes:
+        remaining: list[IPNetwork] = []
+        for network in result:
+            if network.version != exclude.version or not network.overlaps(exclude):
+                remaining.append(network)
+            elif network.subnet_of(exclude):  # type: ignore[arg-type]
+                continue
+            else:
+                remaining.extend(network.address_exclude(exclude))  # type: ignore[arg-type]
+        result = remaining
+    return result
+
+
+def normalise_domain(value: str) -> str:
+    domain = str(value).strip().lower().rstrip(".")
+    for scheme in ("https://", "http://"):
+        domain = domain.removeprefix(scheme)
+    return domain.split("/", 1)[0].split(":", 1)[0]
+
+
+def wildcard_suffix(domain: str) -> str | None:
+    """``*.foo.com`` -> ``foo.com``; ``autodiscover.*.onmicrosoft.com`` -> ``onmicrosoft.com``; else ``None``."""
+    domain = PLACEHOLDER_RE.sub("*", domain)
+    if "*" not in domain:
+        return None
+    labels = domain.split(".")
+    last_wildcard = max(index for index, label in enumerate(labels) if "*" in label)
+    return ".".join(labels[last_wildcard + 1 :]) or None
+
+
+def root_domain(domain: str) -> str:
+    labels = domain.split(".")
+    if len(labels) >= 3 and ".".join(labels[-2:]) in MULTI_LABEL_SUFFIXES:
+        return ".".join(labels[-3:])
+    return ".".join(labels[-2:])
+
+
+def covered_by(domain: str, suffixes: Iterable[str]) -> bool:
+    """True when ``domain`` equals or is a subdomain of any of ``suffixes``."""
+    return any(domain == suffix or domain.endswith("." + suffix) for suffix in suffixes)
+
+
+def minimise_domains(domains: Iterable[str]) -> list[str]:
+    """Drop domains already covered by a shorter routing domain in the same set and sort the rest."""
+    unique = set(domains)
+    kept = [domain for domain in unique if not covered_by(domain, unique - {domain})]
+    return sorted(kept)
+
+
+def is_valid_domain(domain: str) -> bool:
+    return bool(DOMAIN_RE.match(domain))

ms_split_router/render.py

@@ -0,0 +1,221 @@
+"""Render systemd unit-style INI files (.network, .network.d drop-ins, .link, networkd.conf.d, resolved.conf.d)."""
+
+from collections.abc import Iterable, Sequence
+from dataclasses import dataclass
+from typing import Literal
+
+from . import GENERATOR, __version__
+from .config import DefaultLink, ExtraSections, Match, NetworkdConf, ResolvedConf, SplitLink
+from .netutil import IPAddress, IPNetwork
+
+MARKER = f"# Generated by {GENERATOR}"
+NETWORK_DIR = "etc/systemd/network"
+NETWORKD_CONF_PATH = "etc/systemd/networkd.conf.d/10-ms-split-router.conf"
+RESOLVED_CONF_PATH = "etc/systemd/resolved.conf.d/10-ms-split-router.conf"
+DOMAINS_LINE_WIDTH = 110
+
+type Kind = Literal["network", "link", "networkd_conf", "resolved_conf"]
+type Section = tuple[str, list[tuple[str, str]]]
+
+
+@dataclass(frozen=True, slots=True)
+class RenderedFile:
+    path: str  # relative to the root directory, e.g. "etc/systemd/network/10-ms-split-vpn.network"
+    content: str
+    kind: Kind
+
+
+@dataclass(frozen=True, slots=True)
+class RouteSpec:
+    destination: IPNetwork
+    gateway: IPAddress
+    onlink: bool
+    metric: int | None
+
+
+def split_network_path(link: SplitLink) -> str:
+    if link.style == "dropin":
+        return f"{NETWORK_DIR}/{link.base}.d/50-ms-split-router-{link.id}.conf"
+    return f"{NETWORK_DIR}/10-ms-split-{link.id}.network"
+
+
+def default_network_path(link: DefaultLink) -> str:
+    if link.style == "dropin":
+        return f"{NETWORK_DIR}/{link.base}.d/50-ms-split-router-{link.id}.conf"
+    return f"{NETWORK_DIR}/20-ms-default-{link.id}.network"
+
+
+def link_file_path(link: SplitLink) -> str:
+    return f"{NETWORK_DIR}/10-ms-split-{link.id}.link"
+
+
+def header(description: str, details: Iterable[str] = ()) -> str:
+    lines = [
+        f"{MARKER} {__version__}. Do not edit: changes are overwritten on the next run.",
+        f"# {description}",
+        *(f"# {line}" for line in details),
+    ]
+    return "\n".join(lines) + "\n"
+
+
+def format_sections(sections: Sequence[Section]) -> str:
+    blocks = []
+    for name, entries in sections:
+        blocks.append("\n".join([f"[{name}]", *(f"{key}={value}" for key, value in entries)]))
+    return "\n\n".join(blocks) + "\n"
+
+
+def wrap_domains(domains: Sequence[str], width: int = DOMAINS_LINE_WIDTH) -> list[str]:
+    """Spread the domain list over several ``Domains=`` lines; systemd appends repeated assignments."""
+    lines: list[str] = []
+    current: list[str] = []
+    for domain in domains:
+        if current and len(" ".join([*current, domain])) > width:
+            lines.append(" ".join(current))
+            current = []
+        current.append(domain)
+    if current:
+        lines.append(" ".join(current))
+    return lines
+
+
+def _match_section(match: Match) -> Section:
+    if match.mac:
+        return ("Match", [("MACAddress", match.mac)])
+    # Name= matches the kernel name and the alternative names.
+    return ("Match", [("Name", match.altname or match.name or "")])
+
+
+def _dns_entries(
+    dns: Sequence[str], domains: Sequence[str], dns_default_route: bool, resolve: Iterable[tuple[str, str]]
+) -> list[tuple[str, str]]:
+    entries = [("DNS", server) for server in dns]
+    entries += [("Domains", line) for line in wrap_domains(domains)]
+    entries.append(("DNSDefaultRoute", "yes" if dns_default_route else "no"))
+    entries += list(resolve)
+    return entries
+
+
+# WSL assigns the addresses of mirrored links; networkd must not run its own address configuration.
+_UNMANAGED_ADDRESSING = [
+    ("DHCP", "no"),
+    ("IPv6AcceptRA", "no"),
+    ("LinkLocalAddressing", "no"),
+    ("KeepConfiguration", "yes"),
+]
+
+
+def _route_sections(routes: Sequence[RouteSpec]) -> list[Section]:
+    sections: list[Section] = []
+    for route in routes:
+        entries = [("Destination", str(route.destination)), ("Gateway", str(route.gateway))]
+        if route.onlink:
+            entries.append(("GatewayOnLink", "yes"))
+        if route.metric is not None:
+            entries.append(("Metric", str(route.metric)))
+        sections.append(("Route", entries))
+    return sections
+
+
+def render_split_network(
+    link: SplitLink, dns: Sequence[str], domains: Sequence[str], routes: Sequence[RouteSpec], details: Sequence[str]
+) -> RenderedFile:
+    network_entries = []
+    if link.style == "full":
+        network_entries += _UNMANAGED_ADDRESSING
+    if dns:
+        routing_domains = [f"~{domain}" for domain in domains]
+        network_entries += _dns_entries(dns, routing_domains, link.dns_default_route, link.resolve.keys())
+    sections: list[Section] = []
+    if link.style == "full":
+        assert link.match is not None
+        sections += [_match_section(link.match), ("Link", [("RequiredForOnline", link.required_for_online)])]
+    if network_entries:
+        sections.append(("Network", network_entries))
+    sections += _route_sections(routes)
+    description = f"Split-tunnel link '{link.id}'" + (
+        f" ({link.match.describe()})" if link.match else f" (drop-in for {link.base})"
+    )
+    content = header(description, details) + "\n" + format_sections(sections)
+    return RenderedFile(split_network_path(link), content, "network")
+
+
+def render_default_network(link: DefaultLink) -> RenderedFile:
+    network_entries = []
+    if link.style == "full":
+        network_entries += _UNMANAGED_ADDRESSING
+    network_entries += _dns_entries(link.dns, link.domains, link.dns_default_route, link.resolve.keys())
+    sections: list[Section] = []
+    if link.style == "full":
+        assert link.match is not None
+        sections += [_match_section(link.match), ("Link", [("RequiredForOnline", link.required_for_online)])]
+    sections.append(("Network", network_entries))
+    description = f"Default link '{link.id}'" + (
+        f" ({link.match.describe()})" if link.match else f" (drop-in for {link.base})"
+    )
+    return RenderedFile(default_network_path(link), header(description) + "\n" + format_sections(sections), "network")
+
+
+def render_altname_link(link: SplitLink) -> RenderedFile:
+    assert link.match is not None and link.match.mac and link.altname_link
+    sections: list[Section] = [
+        ("Match", [("MACAddress", link.match.mac)]),
+        (
+            "Link",
+            [
+                # Same naming behaviour as systemd's 99-default.link, which this file supersedes for the device.
+                ("NamePolicy", "keep kernel database onboard slot path"),
+                ("AlternativeNamesPolicy", "database onboard slot path mac"),
+                ("AlternativeName", link.altname_link),
+                # Never rewrite the MAC that WSL mirrors from the Windows adapter.
+                ("MACAddressPolicy", "none"),
+            ],
+        ),
+    ]
+    description = f"Stable alternative name '{link.altname_link}' for split-tunnel link '{link.id}'"
+    return RenderedFile(link_file_path(link), header(description) + "\n" + format_sections(sections), "link")
+
+
+def _with_extra(sections: list[Section], extra: ExtraSections) -> list[Section]:
+    merged: dict[str, list[tuple[str, str]]] = {name: list(entries) for name, entries in sections}
+    for section, keys in extra.items():
+        entries = merged.setdefault(section, [])
+        for key, values in keys.items():
+            entries[:] = [entry for entry in entries if entry[0] != key]
+            entries.extend((key, value) for value in values)
+    return [(name, entries) for name, entries in merged.items() if entries]
+
+
+def render_networkd_conf(conf: NetworkdConf) -> RenderedFile:
+    sections: list[Section] = [
+        (
+            "Network",
+            [
+                ("ManageForeignRoutes", "yes" if conf.manage_foreign_routes else "no"),
+                ("ManageForeignRoutingPolicyRules", "yes" if conf.manage_foreign_routing_policy_rules else "no"),
+            ],
+        )
+    ]
+    description = "Keep the addresses, routes and policy rules that WSL installs on mirrored links"
+    content = header(description) + "\n" + format_sections(_with_extra(sections, conf.extra))
+    return RenderedFile(NETWORKD_CONF_PATH, content, "networkd_conf")
+
+
+def render_resolved_conf(conf: ResolvedConf) -> RenderedFile | None:
+    entries = [("DNSSEC", conf.dnssec)] if conf.dnssec is not None else []
+    sections = _with_extra([("Resolve", entries)], conf.extra)
+    if not sections:
+        return None
+    description = "Global systemd-resolved settings for the split-tunnel setup"
+    return RenderedFile(RESOLVED_CONF_PATH, header(description) + "\n" + format_sections(sections), "resolved_conf")
+
+
+def gateway_conflicts(prefixes: Iterable[IPNetwork], gateway: IPAddress | None) -> list[IPNetwork]:
+    """Prefixes that contain the gateway itself (the gateway would be routed via itself)."""
+    if gateway is None:
+        return []
+    return [prefix for prefix in prefixes if prefix.version == gateway.version and gateway in prefix]
+
+
+def route_specs(prefixes: Iterable[IPNetwork], gateway: IPAddress, onlink: bool, metric: int | None) -> list[RouteSpec]:
+    return [RouteSpec(prefix, gateway, onlink, metric) for prefix in prefixes]