gowalk-cicd 1.0.149 → 1.0.151

package/backend-action/network_owned_inventory.py

@@ -0,0 +1,118 @@
+"""Read exact requested network ownership without admitting any address-space allocation."""
+import re
+
+from network_inventory import Reader
+from network_pools import InventoryFailure, decode, prefix
+
+LISTING = ['docker', 'network', 'ls', '--no-trunc', '--format',
+           '{"Id":{{json .ID}},"Name":{{json .Name}}}']
+
+
+def listing(raw, names):
+    rows, identifiers, selected = raw.splitlines(), set(), {}
+    if len(rows) > 1024:
+        raise InventoryFailure('inventory_invalid')
+    for raw_row in rows:
+        row = decode(raw_row)
+        if (not isinstance(row, dict) or set(row) != {'Id', 'Name'}
+                or not isinstance(row['Id'], str) or not re.fullmatch('[a-f0-9]{64}', row['Id'])
+                or not isinstance(row['Name'], str)
+                or not re.fullmatch('[A-Za-z0-9][A-Za-z0-9_.-]{0,255}', row['Name'])
+                or row['Id'] in identifiers):
+            raise InventoryFailure('inventory_invalid')
+        identifiers.add(row['Id'])
+        if row['Name'] in names:
+            if row['Name'] in selected:
+                raise InventoryFailure('inventory_invalid')
+            selected[row['Name']] = row['Id']
+    return selected
+
+
+def string_mapping(value):
+    if value is None:
+        return {}
+    if (not isinstance(value, dict)
+            or any(not isinstance(k, str) or not isinstance(v, str) for k, v in value.items())):
+        raise InventoryFailure('inventory_invalid')
+    return dict(value)
+
+
+def ownership_ipam(ipam):
+    """Validate subnet evidence without assuming the selected network's IPAM driver."""
+    if (not isinstance(ipam, dict) or set(ipam) - {'Driver', 'Options', 'Config'}
+            or not isinstance(ipam.get('Driver'), str) or not 1 <= len(ipam['Driver']) <= 256
+            or 'Config' not in ipam):
+        raise InventoryFailure('inventory_invalid')
+    pools = ipam['Config']
+    if pools is None:
+        pools = []
+    if not isinstance(pools, list) or len(pools) > 64:
+        raise InventoryFailure('inventory_invalid')
+    subnets = []
+    for pool in pools:
+        if not isinstance(pool, dict) or set(pool) - {'Subnet', 'Gateway', 'IPRange', 'AuxiliaryAddresses'}:
+            raise InventoryFailure('inventory_invalid')
+        subnet = prefix(pool.get('Subnet'), strict=True)
+        for key in ('Gateway', 'IPRange'):
+            if pool.get(key):
+                address = prefix(pool[key])
+                if address.version != subnet.version or not address.subnet_of(subnet):
+                    raise InventoryFailure('inventory_invalid')
+        for value in string_mapping(pool.get('AuxiliaryAddresses')).values():
+            address = prefix(value)
+            if address.version != subnet.version or not address.subnet_of(subnet):
+                raise InventoryFailure('inventory_invalid')
+        subnets.append(dict(pool))
+    return {'Driver': ipam['Driver'], 'Options': string_mapping(ipam.get('Options')), 'Config': subnets}
+
+
+def ownership_record(row):
+    """Keep the private contract fields; public receipts must project this record separately."""
+    if not isinstance(row, dict):
+        raise InventoryFailure('inventory_invalid')
+    result = {key: row.get(key) for key in ('Id', 'Name', 'Driver', 'Scope', 'Internal', 'Attachable', 'EnableIPv6')}
+    if (not isinstance(result['Driver'], str) or not 1 <= len(result['Driver']) <= 256
+            or result['Scope'] not in ('local', 'swarm', 'global')
+            or any(type(result[key]) is not bool for key in ('Internal', 'Attachable', 'EnableIPv6'))):
+        raise InventoryFailure('inventory_invalid')
+    result.update(Labels=string_mapping(row.get('Labels')), Options=string_mapping(row.get('Options')),
+                  IPAM=ownership_ipam(row.get('IPAM')))
+    return result
+
+
+def inspect_selected(read, selected):
+    networks = []
+    identities = sorted(selected.values())
+    for offset in range(0, len(identities), 32):
+        batch = identities[offset:offset + 32]
+        rows = read(['docker', 'network', 'inspect', *batch])
+        if not isinstance(rows, list) or len(rows) != len(batch):
+            raise InventoryFailure('inventory_invalid')
+        observed = set()
+        for row in rows:
+            network = ownership_record(row)
+            name, identity = network['Name'], network['Id']
+            if (not isinstance(name, str) or not isinstance(identity, str)
+                    or selected.get(name) != identity or identity not in batch or identity in observed):
+                raise InventoryFailure('network_inventory_changed')
+            observed.add(identity)
+            networks.append(network)
+    return networks
+
+
+def ownership_inventory(run, plans):
+    """Inspect complete exact-name matches and recheck them; unrelated details stay unread."""
+    if not isinstance(plans, list) or len(plans) > 64:
+        raise InventoryFailure('inventory_invalid')
+    names = set()
+    for plan in plans:
+        if (not isinstance(plan, dict) or not isinstance(plan.get('name'), str)
+                or not re.fullmatch('[A-Za-z0-9][A-Za-z0-9_.-]{0,255}', plan['name'])):
+            raise InventoryFailure('inventory_invalid')
+        names.add(plan['name'])
+    read = Reader(run)
+    selected = listing(read(LISTING, parsed=False), names)
+    networks = inspect_selected(read, selected)
+    if listing(read(LISTING, parsed=False), names) != selected:
+        raise InventoryFailure('network_inventory_changed')
+    return {'networks': networks}

package/backend-action/network_pool_facts.json

@@ -0,0 +1,214 @@
+{
+  "schema": "gowalk-cicd/moby-pool-source-facts.v1",
+  "source_root": "https://raw.githubusercontent.com/moby/moby/v{version}/",
+  "review": "Exact Moby stable tags: localScopeDefaultNetworks constants and configured runtime pool loop.",
+  "fallback_sources": {
+    "20.10.24": "vendor/github.com/docker/libnetwork/ipams/builtin/builtin_unix.go",
+    "28.5.2": "daemon/daemon.go"
+  },
+  "groups": [
+    {
+      "path": "vendor/github.com/docker/libnetwork/ipamutils/utils.go",
+      "sha256": "f82bc0d96c8fdbc63e81432458d6349739dc87110e06ba5f50b000cb7d088271",
+      "versions": [
+        "20.10.0", "20.10.1", "20.10.2", "20.10.3", "20.10.4", "20.10.5", "20.10.6",
+        "20.10.7", "20.10.8", "20.10.9", "20.10.10", "20.10.11", "20.10.12", "20.10.13",
+        "20.10.14", "20.10.15", "20.10.16", "20.10.17", "20.10.18", "20.10.19", "20.10.20",
+        "20.10.21", "20.10.22", "20.10.23", "20.10.24", "20.10.25", "20.10.26", "20.10.27"
+      ]
+    },
+    {
+      "path": "libnetwork/ipamutils/utils.go",
+      "sha256": "c678632dff4f85e5b26c2b61e4f70fd24ab359c43c2400f9e95241ab4a0a1b44",
+      "versions": [
+        "23.0.0", "23.0.1", "23.0.2", "23.0.3", "23.0.4", "23.0.5", "23.0.6",
+        "23.0.7", "23.0.8", "23.0.9", "23.0.10", "23.0.11", "23.0.12", "23.0.13",
+        "23.0.14", "23.0.15", "23.0.16", "23.0.17", "23.0.18"
+      ]
+    },
+    {
+      "path": "libnetwork/ipamutils/utils.go",
+      "sha256": "344fafa24387c51705e6ef48901d02d0f49a2c1c03a88786579d28cc50f7f345",
+      "versions": [
+        "24.0.0", "24.0.1", "24.0.2", "24.0.3", "24.0.4", "24.0.5", "24.0.6",
+        "24.0.7", "24.0.8", "24.0.9"
+      ]
+    },
+    {
+      "path": "libnetwork/ipamutils/utils.go",
+      "sha256": "a966d617cfb7ff2521fc9043f8a690f96b9cc2cc4cc94adcf1e101ad65dcbd88",
+      "versions": [
+        "25.0.0", "25.0.1", "25.0.2", "25.0.3", "25.0.4", "25.0.5", "25.0.7",
+        "25.0.8", "25.0.9", "25.0.10", "25.0.11", "25.0.12", "25.0.14", "25.0.15",
+        "25.0.16", "26.0.0", "26.0.1", "26.0.2", "26.1.0", "26.1.1", "26.1.2",
+        "26.1.3", "26.1.4"
+      ]
+    },
+    {
+      "path": "libnetwork/ipamutils/utils.go",
+      "sha256": "60604c3228b54984b0ed53f866d53d98f58d4cce143f2323aea2e3ca54b24c62",
+      "versions": [
+        "27.0.1", "27.0.2", "27.0.3", "27.1.0", "27.1.1", "27.1.2", "27.2.0",
+        "27.2.1"
+      ]
+    },
+    {
+      "path": "libnetwork/ipamutils/utils.go",
+      "sha256": "66fffb43db9e9337501b6d6da335ab164dd6abee1dadee0be1a373c228419606",
+      "versions": [
+        "27.3.0", "27.3.1"
+      ]
+    },
+    {
+      "path": "libnetwork/ipamutils/utils.go",
+      "sha256": "438b42fe2dc96a33deb77fdc29c97691e6a046cf3026e3c1967a64b2360126c2",
+      "versions": [
+        "27.4.0", "27.4.1", "27.5.0", "27.5.1", "28.0.0", "28.0.1", "28.0.2",
+        "28.0.3", "28.0.4", "28.1.0"
+      ]
+    },
+    {
+      "path": "libnetwork/ipamutils/utils.go",
+      "sha256": "f28ba6c14feffabb9b83e85aa6d1e440ff1f028f0984d4a926bd0c36b8521815",
+      "versions": [
+        "28.1.1", "28.2.0", "28.2.1", "28.2.2", "28.3.0", "28.3.1", "28.3.2",
+        "28.3.3", "28.4.0", "28.5.0", "28.5.1", "28.5.2"
+      ]
+    },
+    {
+      "path": "daemon/info.go",
+      "sha256": "1f3c7eed3365f856aff5aa7fe1ec1ceba6d00dcdb15cdc338b171d51426d9819",
+      "versions": [
+        "20.10.0", "20.10.1"
+      ]
+    },
+    {
+      "path": "daemon/info.go",
+      "sha256": "3c2a38fd2ff8a71ac65d53328c7fce24b04e32c518df078cccaeac4a54eaf607",
+      "versions": [
+        "20.10.2", "20.10.3", "20.10.4", "20.10.5"
+      ]
+    },
+    {
+      "path": "daemon/info.go",
+      "sha256": "fa03341c85ee1299c9808ccd121112285bb851a5b77b2534cf5f655f9985e8a1",
+      "versions": [
+        "20.10.6", "20.10.7", "20.10.8", "20.10.9", "20.10.10", "20.10.11", "20.10.12",
+        "20.10.13", "20.10.14", "20.10.15", "20.10.16", "20.10.17", "20.10.18", "20.10.19",
+        "20.10.20", "20.10.21", "20.10.22", "20.10.23", "20.10.24", "20.10.25", "20.10.26",
+        "20.10.27"
+      ]
+    },
+    {
+      "path": "daemon/info.go",
+      "sha256": "197bc9eac1618225c0ed001360c1b57b651adbb8af5293b124703cf701d115c2",
+      "versions": [
+        "23.0.0", "23.0.1", "23.0.2", "23.0.3", "23.0.4", "23.0.5", "23.0.6",
+        "23.0.7", "23.0.8", "23.0.9", "23.0.10", "23.0.11", "23.0.12", "23.0.13",
+        "23.0.14", "23.0.15", "23.0.16", "23.0.17", "23.0.18"
+      ]
+    },
+    {
+      "path": "daemon/info.go",
+      "sha256": "857b5dc11753d2f6098dccf3d9af61f6f4d20e8369d3e1f86419ba610ea11ac5",
+      "versions": [
+        "24.0.0", "24.0.1", "24.0.2", "24.0.3", "24.0.4", "24.0.5", "24.0.6",
+        "24.0.7"
+      ]
+    },
+    {
+      "path": "daemon/info.go",
+      "sha256": "3772ab50c23edf7257243bd58746148978ae0dcc4e637b5ef120c10879373578",
+      "versions": [
+        "24.0.8", "24.0.9"
+      ]
+    },
+    {
+      "path": "daemon/info.go",
+      "sha256": "08fbe5e83aec2b83c89a1dcf1af426d68a494570fff8358c3772a31470890204",
+      "versions": [
+        "25.0.0", "25.0.1", "25.0.2", "25.0.3", "25.0.4", "25.0.5", "25.0.7",
+        "25.0.8", "25.0.9"
+      ]
+    },
+    {
+      "path": "daemon/info.go",
+      "sha256": "82955e39ef8cbd1defdd1b74c14433fbbe455cb944b8d6d8aeae983105fe09f6",
+      "versions": [
+        "25.0.10", "25.0.11", "25.0.12", "25.0.14", "25.0.15", "25.0.16"
+      ]
+    },
+    {
+      "path": "daemon/info.go",
+      "sha256": "158836396d4f4f17756f932028e74b253bf089478f257a78a0df29781770a426",
+      "versions": [
+        "26.0.0", "26.0.1", "26.0.2", "26.1.0", "26.1.1", "26.1.2", "26.1.3",
+        "26.1.4"
+      ]
+    },
+    {
+      "path": "daemon/info.go",
+      "sha256": "0d3fc255e4fe964851a74ee6396b33ae0f5d35fd8ab9699f9849bd4816c8de0a",
+      "versions": [
+        "27.0.1", "27.0.2", "27.0.3", "27.1.0", "27.1.1", "27.1.2"
+      ]
+    },
+    {
+      "path": "daemon/info.go",
+      "sha256": "4561f3eafe327c5bfac7c6a9cba25833dece6e540013a1f8dbc1e05d4008feab",
+      "versions": [
+        "27.2.0", "27.2.1", "27.3.0", "27.3.1"
+      ]
+    },
+    {
+      "path": "daemon/info.go",
+      "sha256": "482bb3b0336a2d6245e364e4572eadb09bfd19c8a1f4bbf431f82a86fce7e2cc",
+      "versions": [
+        "27.4.0", "27.4.1"
+      ]
+    },
+    {
+      "path": "daemon/info.go",
+      "sha256": "edebebe8c9d4fe716ff055e8b2ce5eb541aa949e1fc3f36c7bf86630317ff843",
+      "versions": [
+        "27.5.0", "27.5.1"
+      ]
+    },
+    {
+      "path": "daemon/info.go",
+      "sha256": "47b912bc65d9f1ef3f2136c6c294fc67f894a10b41d8795e0fe23ac0e9724821",
+      "versions": [
+        "28.0.0", "28.0.1", "28.0.2", "28.0.3", "28.0.4"
+      ]
+    },
+    {
+      "path": "daemon/info.go",
+      "sha256": "23a585ec2407b912aa527f474b76accde8ed27b617b2003dfb81417de694b1f9",
+      "versions": [
+        "28.1.0"
+      ]
+    },
+    {
+      "path": "daemon/info.go",
+      "sha256": "a261057379a12afaf9d5648960c614affb1b155778559e933b2d5910d372525f",
+      "versions": [
+        "28.1.1"
+      ]
+    },
+    {
+      "path": "daemon/info.go",
+      "sha256": "3f0eebc794400b091c4a7dc858630691b2bf26cea4305dc7656ce93c1052e8f6",
+      "versions": [
+        "28.2.0", "28.2.1", "28.2.2"
+      ]
+    },
+    {
+      "path": "daemon/info.go",
+      "sha256": "6bc4ef7084e3a0b7a523630039d2c560fb5cb1b367bc0b8021606e60a40916be",
+      "versions": [
+        "28.3.0", "28.3.1", "28.3.2", "28.3.3", "28.4.0", "28.5.0", "28.5.1",
+        "28.5.2"
+      ]
+    }
+  ]
+}

package/backend-action/network_pools.py

@@ -0,0 +1,261 @@
+"""Strict address-space observations; no guessed ranges or host mutations (Python 3.8)."""
+import ipaddress
+import json
+import re
+
+FAILURES = frozenset({
+    'inventory_command_failed', 'inventory_timeout', 'inventory_output_limit', 'inventory_invalid',
+    'network_inventory_changed', 'host_inventory_changed', 'network_ipam_unsupported',
+    'host_namespace_unverified', 'docker_endpoint_unsupported', 'docker_engine_unsupported',
+    'pool_provenance_unknown', 'pool_inventory_invalid', 'host_routes_unsupported',
+    'host_rules_unsupported', 'host_addresses_invalid', 'resolver_inventory_invalid',
+    'resolver_upstream_unknown',
+})
+PRIVATE = tuple(ipaddress.ip_network(value) for value in ('10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16'))
+DEVICE = re.compile(r'[A-Za-z0-9][A-Za-z0-9_.:-]{0,14}')
+
+# Exact tags were read and compared; source hashes are in network_pool_facts.json.
+BUILTIN_VERSIONS = frozenset({
+    '20.10.0', '20.10.1', '20.10.2', '20.10.3', '20.10.4', '20.10.5', '20.10.6', '20.10.7',
+    '20.10.8', '20.10.9', '20.10.10', '20.10.11', '20.10.12', '20.10.13', '20.10.14', '20.10.15',
+    '20.10.16', '20.10.17', '20.10.18', '20.10.19', '20.10.20', '20.10.21', '20.10.22', '20.10.23',
+    '20.10.24', '20.10.25', '20.10.26', '20.10.27', '23.0.0', '23.0.1', '23.0.2', '23.0.3',
+    '23.0.4', '23.0.5', '23.0.6', '23.0.7', '23.0.8', '23.0.9', '23.0.10', '23.0.11',
+    '23.0.12', '23.0.13', '23.0.14', '23.0.15', '23.0.16', '23.0.17', '23.0.18', '24.0.0',
+    '24.0.1', '24.0.2', '24.0.3', '24.0.4', '24.0.5', '24.0.6', '24.0.7', '24.0.8',
+    '24.0.9', '25.0.0', '25.0.1', '25.0.2', '25.0.3', '25.0.4', '25.0.5', '25.0.7',
+    '25.0.8', '25.0.9', '25.0.10', '25.0.11', '25.0.12', '25.0.14', '25.0.15', '25.0.16',
+    '26.0.0', '26.0.1', '26.0.2', '26.1.0', '26.1.1', '26.1.2', '26.1.3', '26.1.4',
+    '27.0.1', '27.0.2', '27.0.3', '27.1.0', '27.1.1', '27.1.2', '27.2.0', '27.2.1',
+    '27.3.0', '27.3.1', '27.4.0', '27.4.1', '27.5.0', '27.5.1', '28.0.0', '28.0.1',
+    '28.0.2', '28.0.3', '28.0.4', '28.1.0', '28.1.1', '28.2.0', '28.2.1', '28.2.2',
+    '28.3.0', '28.3.1', '28.3.2', '28.3.3', '28.4.0', '28.5.0', '28.5.1', '28.5.2',
+})
+BUILTIN_POOLS = (
+    {'Base': '172.17.0.0/16', 'Size': 16},
+    {'Base': '172.18.0.0/16', 'Size': 16},
+    {'Base': '172.19.0.0/16', 'Size': 16},
+    {'Base': '172.20.0.0/14', 'Size': 16},
+    {'Base': '172.24.0.0/14', 'Size': 16},
+    {'Base': '172.28.0.0/14', 'Size': 16},
+    {'Base': '192.168.0.0/16', 'Size': 20},
+)
+
+
+class InventoryFailure(Exception):
+    def __init__(self, code):
+        self.code = code if code in FAILURES else 'inventory_invalid'
+        self.details = {}
+        super().__init__(self.code)
+
+
+def unique_object(pairs):
+    result = {}
+    for key, value in pairs:
+        if key in result:
+            raise InventoryFailure('inventory_invalid')
+        result[key] = value
+    return result
+
+
+def decode(raw):
+    try:
+        return json.loads(raw, object_pairs_hook=unique_object, parse_constant=reject_constant)
+    except (ValueError, TypeError, UnicodeError, RecursionError):
+        raise InventoryFailure('inventory_invalid') from None
+
+
+def reject_constant(value):
+    raise InventoryFailure('inventory_invalid')
+
+
+def prefix(value, *, strict=False):
+    if not isinstance(value, str) or len(value) > 128 or '%' in value:
+        raise InventoryFailure('inventory_invalid')
+    try:
+        return ipaddress.ip_network(value, strict=strict)
+    except ValueError:
+        raise InventoryFailure('inventory_invalid') from None
+
+
+def effective_pools(raw, version):
+    """Only exact reviewed release versions permit the empty-info builtin fallback."""
+    source = 'engine_info'
+    if raw is None or raw == []:
+        if version not in BUILTIN_VERSIONS:
+            raise InventoryFailure('pool_provenance_unknown')
+        raw, source = list(BUILTIN_POOLS), 'versioned_moby_builtin'
+    if not isinstance(raw, list) or not raw or len(raw) > 64:
+        raise InventoryFailure('pool_inventory_invalid')
+    result = []
+    for row in raw:
+        if not isinstance(row, dict) or set(row) != {'Base', 'Size'}:
+            raise InventoryFailure('pool_inventory_invalid')
+        base, size = prefix(row['Base'], strict=True), row['Size']
+        if type(size) is not int or not base.prefixlen <= size <= base.max_prefixlen:
+            raise InventoryFailure('pool_inventory_invalid')
+        if base.version == 6:
+            continue
+        if not any(base.subnet_of(space) for space in PRIVATE):
+            raise InventoryFailure('pool_inventory_invalid')
+        if any(base.overlaps(prefix(other['base'])) for other in result):
+            raise InventoryFailure('pool_inventory_invalid')
+        result.append({'base': str(base), 'size': size})
+    if not result:
+        raise InventoryFailure('pool_inventory_invalid')
+    return result, source
+
+
+def route_exclusions(rows, records=None):
+    """All IPv4 tables are observed; unsupported forwarding mechanisms refuse."""
+    allowed = {'dst', 'type', 'gateway', 'prefsrc', 'src', 'dev', 'protocol', 'scope', 'table',
+               'metric', 'flags', 'tos', 'mtu', 'advmss', 'initcwnd', 'initrwnd', 'rto_min',
+               'quickack', 'congctl', 'features', 'expires', 'pref', 'nexthops', 'multipath'}
+    result, records = set(), records if records is not None else []
+    if not isinstance(rows, list) or not rows or len(rows) > 8192:
+        raise InventoryFailure('host_routes_unsupported')
+    for row in rows:
+        if (not isinstance(row, dict) or set(row) - allowed or 'dst' not in row
+                or row.get('type', 'unicast') not in
+                {'unicast', 'local', 'broadcast', 'multicast', 'blackhole', 'unreachable', 'prohibit', 'throw'}):
+            raise InventoryFailure('host_routes_unsupported')
+        device, kind = row.get('dev', ''), 'route_other'
+        if (not isinstance(device, str) or (device and not DEVICE.fullmatch(device))
+                or any(type(row.get(key, '')) not in (str, int) for key in ('scope', 'table', 'protocol'))):
+            raise InventoryFailure('host_routes_unsupported')
+        table = {254: 'main', 255: 'local'}.get(row.get('table'), row.get('table', 'main'))
+        signature = (row.get('type', 'unicast'), row.get('scope'), table)
+        if row.get('protocol') == 'kernel' and not set(row) - {
+                'dst', 'type', 'dev', 'protocol', 'scope', 'table', 'prefsrc', 'flags'}:
+            kind = {('unicast', 'link', 'main'): 'route_connected', ('local', 'host', 'local'): 'route_local',
+                    ('broadcast', 'link', 'local'): 'route_broadcast'}.get(signature, 'route_other')
+        if row['dst'] != 'default':
+            destination = prefix(row['dst'])
+            if destination.version != 4 or destination.prefixlen == 0:
+                raise InventoryFailure('host_routes_unsupported')
+            result.add(str(destination))
+            records.append({'subnet': str(destination), 'kind': kind, 'device': device})
+        elif row.get('table') in (52, '52'):
+            # A Tailscale exit route precedes main and can divert a new bridge's own traffic.
+            raise InventoryFailure('host_routes_unsupported')
+        paths = row.get('nexthops', row.get('multipath', []))
+        if not isinstance(paths, list) or len(paths) > 256:
+            raise InventoryFailure('host_routes_unsupported')
+        for path in [row] + paths:
+            if not isinstance(path, dict) or (path is not row and set(path) - {'gateway', 'dev', 'weight', 'flags'}):
+                raise InventoryFailure('host_routes_unsupported')
+            device = path.get('dev', '')
+            if not isinstance(device, str) or (device and not DEVICE.fullmatch(device)):
+                raise InventoryFailure('host_routes_unsupported')
+            for key in ('gateway', 'prefsrc', 'src'):
+                if key in path:
+                    address = prefix(path[key])
+                    if address.version != 4:
+                        raise InventoryFailure('host_routes_unsupported')
+                    result.add(str(address))
+                    observed = kind + '_source' if key == 'prefsrc' else 'route_' + key
+                    records.append({'subnet': str(address), 'kind': observed, 'device': device})
+    return result
+
+
+def address_exclusions(rows, records=None):
+    result, records = set(), records if records is not None else []
+    if not isinstance(rows, list) or not rows or len(rows) > 4096:
+        raise InventoryFailure('host_addresses_invalid')
+    for row in rows:
+        if not isinstance(row, dict) or not isinstance(row.get('addr_info'), list):
+            raise InventoryFailure('host_addresses_invalid')
+        device = row.get('ifname')
+        if not isinstance(device, str) or not DEVICE.fullmatch(device):
+            raise InventoryFailure('host_addresses_invalid')
+        for address in row['addr_info']:
+            if (not isinstance(address, dict) or address.get('family') != 'inet'
+                    or type(address.get('prefixlen')) is not int or not 0 <= address['prefixlen'] <= 32):
+                raise InventoryFailure('host_addresses_invalid')
+            local = prefix(address.get('local'))
+            if local.version != 4 or local.prefixlen != 32:
+                raise InventoryFailure('host_addresses_invalid')
+            subnet = str(prefix(str(local.network_address) + '/' + str(address['prefixlen'])))
+            result.add(subnet)
+            records.append({'subnet': subnet, 'kind': 'address_network', 'device': device})
+            records.append({'subnet': str(local), 'kind': 'address_local', 'device': device})
+            for key in ('peer', 'broadcast'):
+                if key in address:
+                    peer = prefix(address[key])
+                    if peer.version != 4:
+                        raise InventoryFailure('host_addresses_invalid')
+                    result.add(str(peer))
+                    records.append({'subnet': str(peer), 'kind': 'address_' + key, 'device': device})
+    if not result:
+        raise InventoryFailure('host_addresses_invalid')
+    return result
+
+
+def validate_rules(rows):
+    """Admit ordinary Linux rules or the exact Tailscale v1.88.2 baseIPRules chain."""
+    # https://github.com/tailscale/tailscale/blob/v1.88.2/wgengine/router/router_linux.go
+    if not isinstance(rows, list) or len(rows) not in (3, 7):
+        raise InventoryFailure('host_rules_unsupported')
+    expected = [{'priority': p, 'src': 'all', 'table': t}
+                for p, t in ((0, 'local'), (32766, 'main'), (32767, 'default'))]
+    if len(rows) == 7:
+        marked = {'src': 'all', 'fwmark': '0x80000', 'fwmask': '0xff0000'}
+        expected += [dict(marked, priority=5210, table='main'), dict(marked, priority=5230, table='default'),
+                     dict(marked, priority=5250, action='unreachable'), {'priority': 5270, 'src': 'all', 'table': 52}]
+    actual = []
+    tables = {255: 'local', 254: 'main', 253: 'default'}
+    for row in rows:
+        if (not isinstance(row, dict) or set(row) - {'priority', 'src', 'table', 'protocol',
+                                                   'fwmark', 'fwmask', 'action'}
+                or type(row.get('priority')) is not int or row.get('src') != 'all'):
+            raise InventoryFailure('host_rules_unsupported')
+        normalized = {key: value for key, value in row.items() if key != 'protocol'}
+        table = normalized.get('table')
+        if table is not None:
+            if type(table) not in (str, int):
+                raise InventoryFailure('host_rules_unsupported')
+            normalized['table'] = tables.get(table, table)
+        if normalized not in expected or normalized in actual:
+            raise InventoryFailure('host_rules_unsupported')
+        actual.append(normalized)
+    if len(actual) != len(expected):
+        raise InventoryFailure('host_rules_unsupported')
+
+
+def resolver_exclusions(raw, *, resolved=False, records=None):
+    """Parse resolver addresses only; local stubs require authoritative upstream data."""
+    try:
+        lines = raw.decode('utf-8').splitlines()
+    except (AttributeError, UnicodeError):
+        raise InventoryFailure('resolver_inventory_invalid') from None
+    result, stub, observed = set(), False, False
+    records = records if records is not None else []
+    for line in lines:
+        if resolved:
+            match = re.fullmatch(r'(?:Global|Link [0-9]+ \([^\r\n:]+\)):\s*(.*)', line.strip())
+            if not match:
+                raise InventoryFailure('resolver_inventory_invalid')
+            words = match[1].split()
+        else:
+            words = line.split('#', 1)[0].split(';', 1)[0].split()
+            if not words or words[0] != 'nameserver':
+                continue
+            if len(words) != 2:
+                raise InventoryFailure('resolver_inventory_invalid')
+            words = words[1:]
+        for word in words:
+            address = prefix(word)
+            observed = True
+            if address.prefixlen != address.max_prefixlen:
+                raise InventoryFailure('resolver_inventory_invalid')
+            if address.version != 4:
+                continue
+            if address.network_address.is_loopback:
+                if resolved or str(address.network_address) not in {'127.0.0.53', '127.0.0.54'}:
+                    raise InventoryFailure('resolver_upstream_unknown')
+                stub = True
+            result.add(str(address))
+            records.append({'subnet': str(address), 'kind': 'resolver', 'device': ''})
+    if not observed:
+        raise InventoryFailure('resolver_inventory_invalid')
+    return result, stub