gowalk-cicd 1.0.207 → 1.0.208

package/README.md

@@ -1390,10 +1390,12 @@ Identity failure logs and source Compose files do not establish this applied sta
 ### Read-only bridge and VPN prerequisite diagnostics
 
 Backend Deploy also offers `operation: network-diagnostics`, with an exact `diagnostic-service`, deployed
-`diagnostic-build-sha`, owned `diagnostic-network`, proposed namespace-only private IPv4 `/24` in
+`diagnostic-build-sha`, owned `diagnostic-network`, proposed namespace-only private IPv4 `/24` or IPv6 ULA `/64` in
 `diagnostic-pool`, exact `diagnostic-vpn-service`, and optional `diagnostic-provider: digitalocean`.
 It reports the owned bridge/IPAM, observed pool conflicts, UDP 500/4500 ownership, bound host identity and
-kernel/firewall facts in a closed v3 artifact. The allocator stays retired; a completed read is never
+kernel/firewall facts in a closed v3 artifact for IPv4 and v4 for IPv6. The IPv6 result also distinguishes
+host and owned-gateway default-route and forwarding observations; actual external connectivity stays unverified.
+The allocator stays retired; a completed read is never
 deployment, port reservation, globally unused address space or tunnel proof. Effective firewall ingress and
 unobserved capabilities remain unverified. The [trusted-host procedure](docs/BACKEND_SSH_GATE.md#owned-bridge-and-vpn-prerequisite-readback)
 defines scope, retained evidence and the required host runtime adoption before this operation is available.

package/backend-action/action.yml

@@ -27,7 +27,7 @@ inputs:
     required: false
     default: default
   diagnostic-pool:
-    description: Proposed strict private IPv4 /24 for a VPN container namespace; never a host allocation.
+    description: Proposed strict private IPv4 /24 or IPv6 ULA /64 for a VPN namespace; never a host allocation.
     required: false
     default: ""
   diagnostic-vpn-service:

package/backend-action/network_host.py

@@ -105,6 +105,75 @@ def local_docker():
         raise NetworkFailure('network_scope_mismatch')
 
 
+def _ipv6_default(raw):
+    if raw is None:
+        return 'unverified'
+    try:
+        rows = json.loads(raw)
+        if not isinstance(rows, list) or any(not isinstance(row, dict) for row in rows):
+            raise ValueError()
+        found = False
+        for row in rows:
+            if row.get('dst', 'default') not in ('default', '::/0'):
+                raise ValueError()
+            flags = row.get('flags', [])
+            if not isinstance(flags, list) or any(not isinstance(flag, str) for flag in flags):
+                raise ValueError()
+            kind = row.get('type', 'unicast')
+            if kind not in ('unicast', 'blackhole', 'unreachable', 'prohibit', 'throw'):
+                raise ValueError()
+            device = row.get('dev')
+            if kind == 'unicast' and (not isinstance(device, str) or not re.fullmatch(r'[A-Za-z0-9_.-]{1,15}', device)):
+                raise ValueError()
+            found |= kind == 'unicast' and device != 'lo' and 'linkdown' not in flags
+        return 'present' if found else 'absent'
+    except (ValueError, TypeError, UnicodeError):
+        return 'unverified'
+
+
+def ipv6_routes(containers, app, service, bridge, namespace_safe=False):
+    host = _ipv6_default(run(['ip', '-j', '-6', 'route', 'show', 'default'], optional=True))
+    host_forward = run(['cat', '/proc/sys/net/ipv6/conf/all/forwarding'], optional=True)
+    forwarding = (None if host_forward is None or host_forward.strip() not in (b'0', b'1')
+                  else host_forward.strip() == b'1')
+    matches = [row for row in containers if row['service'] == service and row['running']]
+    if len(matches) > 1:
+        raise NetworkFailure('network_ambiguous')
+    if not matches:
+        gateway = 'not_running'
+        gateway_forwarding = None
+    elif not namespace_safe:
+        gateway, gateway_forwarding = 'unverified', None
+    else:
+        template = ('{"project":{{json (index .Config.Labels "com.docker.compose.project")}},'
+                    '"service":{{json (index .Config.Labels "com.docker.compose.service")}},'
+                    '"mode":{{json .HostConfig.NetworkMode}},"key":{{json .NetworkSettings.SandboxKey}}}')
+        raw = run(['docker', 'inspect', '--format', template, matches[0]['id']], optional=True)
+        try:
+            record = json.loads(raw) if raw else {}
+            if not isinstance(record, dict):
+                raise ValueError()
+            if record and (record.get('project') != app or record.get('service') != service
+                           or record.get('mode') != bridge['name']):
+                raise NetworkFailure('network_changed')
+            path = record.get('key', '')
+        except (ValueError, UnicodeError):
+            path = ''
+        if not isinstance(path, str):
+            path = ''
+        if not re.fullmatch(r'/var/run/docker/netns/[0-9a-f]{12,64}', path):
+            gateway, gateway_forwarding = 'unverified', None
+        else:
+            entry = ['nsenter', '--net=' + path, '--']
+            raw = run([*entry, 'ip', '-j', '-6', 'route', 'show', 'default'], optional=True)
+            gateway = _ipv6_default(raw)
+            raw = run([*entry, 'cat', '/proc/sys/net/ipv6/conf/all/forwarding'], optional=True)
+            gateway_forwarding = None if raw is None or raw.strip() not in (b'0', b'1') else raw.strip() == b'1'
+    return {'host_ipv6_default_route': host, 'gateway_ipv6_default_route': gateway,
+            'host_ipv6_forwarding': forwarding, 'gateway_ipv6_forwarding': gateway_forwarding,
+            'ipv6_external_connectivity': 'unverified'}
+
+
 def namespace(containers, app, vpn_service, bridge):
     info = run(['docker', 'info', '--format', '{"os":{{json .OSType}},"security":{{json .SecurityOptions}}}'])
     try:

package/backend-action/network_inventory.py

@@ -79,9 +79,11 @@ def selected(rows, app, key):
             'ipam': [{'subnet': x['Subnet'], 'gateway': x.get('Gateway', '')} for x in row['ipam']]}
 
 
-def host_networks():
+def host_networks(include_ipv6=False):
     addresses = decode(run(['ip', '-j', 'address', 'show']))
     routes = decode(run(['ip', '-j', '-4', 'route', 'show', 'table', 'all']))
+    if include_ipv6:
+        routes += decode(run(['ip', '-j', '-6', 'route', 'show', 'table', 'all']))
     result = []
     try:
         for row in addresses:
@@ -102,7 +104,7 @@ def host_networks():
 
 
 def overlap(rows, bridge, host_rows, pool):
-    proposed = ipaddress.IPv4Network(pool)
+    proposed = ipaddress.ip_network(pool, strict=True)
     own = [ipaddress.ip_network(item['subnet']) for item in bridge['ipam']]
     foreign = [ipaddress.ip_network(item['Subnet']) for row in rows if row['id'] != bridge['network_id']
                for item in row['ipam'] or []]

package/backend-action/network_projection.py

@@ -5,6 +5,7 @@ import re
 from runtime_projection import READER_VERSION, PROJECT, SERVICE, SHA, CID
 
 SCHEMA = 'gowalk-cicd/backend-network-diagnostics.v3'
+IPV6_SCHEMA = 'gowalk-cicd/backend-network-diagnostics.v4'
 FAILURES = frozenset({'invalid_scope', 'network_absent', 'network_ambiguous', 'network_scope_mismatch',
     'network_changed', 'network_invalid', 'build_mismatch', 'host_binding_mismatch', 'command_timeout',
     'output_limit', 'command_failed', 'transport_failure', 'remote_invalid', 'artifact_write_failed',
@@ -23,18 +24,22 @@ def scope(app, service, expected, network, pool, vpn_service, host, provider):
     if any(not isinstance(value, str) or not re.fullmatch(pattern, value) for value, pattern in fields):
         raise NetworkFailure('invalid_scope')
     try:
-        candidate = ipaddress.IPv4Network(pool, strict=True)
+        candidate = ipaddress.ip_network(pool, strict=True)
     except (ValueError, TypeError):
         raise NetworkFailure('invalid_scope') from None
     private = ('10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16')
-    if (candidate.prefixlen != 24 or not any(candidate.subnet_of(ipaddress.IPv4Network(x)) for x in private)
-            or provider not in ('none', 'digitalocean')):
+    v4 = (candidate.version == 4 and candidate.prefixlen == 24
+          and any(candidate.subnet_of(ipaddress.IPv4Network(x)) for x in private))
+    v6 = (candidate.version == 6 and candidate.prefixlen == 64
+          and candidate.subnet_of(ipaddress.IPv6Network('fc00::/7')))
+    if not (v4 or v6) or provider not in ('none', 'digitalocean'):
         raise NetworkFailure('invalid_scope')
 
 
 def envelope(app, service, expected, network, pool, vpn_service, host, provider, failure='', *,
              reader_version=READER_VERSION):
-    return {'schema': SCHEMA, 'reader_version': reader_version, 'ok': not failure, 'failure': failure,
+    schema = IPV6_SCHEMA if isinstance(pool, str) and ':' in pool else SCHEMA
+    return {'schema': schema, 'reader_version': reader_version, 'ok': not failure, 'failure': failure,
             'project': app, 'build_service': service, 'expected_build_sha': expected, 'network_key': network,
             'proposed_pool': pool, 'vpn_service': vpn_service, 'expected_host': host, 'provider': provider}
 
@@ -65,7 +70,7 @@ def bridge_record(row, app, network):
             raise NetworkFailure('remote_invalid') from None
 
 
-def observation_records(result):
+def observation_records(result, ipv6=False):
     closed(result['overlap'], ('selected_bridge_foreign_docker', 'selected_bridge_host',
         'pool_selected_bridge', 'pool_foreign_docker', 'pool_host_routes', 'pool_host_addresses',
         'default_gateway_destinations'))
@@ -83,8 +88,12 @@ def observation_records(result):
         if ((row['status'] == 'free') == observed
                 or row['status'] in ('app_vpn', 'foreign') and not row['docker_binding_observed']):
             raise NetworkFailure('remote_invalid')
-    closed(result['namespace'], ('docker_linux_rootful', 'host_ipv4_forwarding', 'xfrm_read',
-        'netfilter_nat_read', 'selected_bridge_masquerade', 'vpn_settings'))
+    fields = {'docker_linux_rootful', 'host_ipv4_forwarding', 'xfrm_read',
+              'netfilter_nat_read', 'selected_bridge_masquerade', 'vpn_settings'}
+    if ipv6:
+        fields |= {'host_ipv6_default_route', 'gateway_ipv6_default_route', 'host_ipv6_forwarding',
+                   'gateway_ipv6_forwarding', 'ipv6_external_connectivity'}
+    closed(result['namespace'], fields)
     for key in ('docker_linux_rootful', 'host_ipv4_forwarding', 'selected_bridge_masquerade'):
         if result['namespace'][key] is not None and type(result['namespace'][key]) is not bool:
             raise NetworkFailure('remote_invalid')
@@ -93,6 +102,14 @@ def observation_records(result):
             raise NetworkFailure('remote_invalid')
     if result['namespace']['vpn_settings'] not in ('absent', 'isolated_net_admin', 'other', 'unverified'):
         raise NetworkFailure('remote_invalid')
+    if ipv6:
+        row = result['namespace']
+        if (row['host_ipv6_default_route'] not in ('present', 'absent', 'unverified')
+                or row['gateway_ipv6_default_route'] not in ('present', 'absent', 'not_running', 'unverified')
+                or any(row[key] is not None and type(row[key]) is not bool
+                       for key in ('host_ipv6_forwarding', 'gateway_ipv6_forwarding'))
+                or row['ipv6_external_connectivity'] != 'unverified'):
+            raise NetworkFailure('remote_invalid')
 
 
 def host_records(result, provider):
@@ -146,6 +163,6 @@ def validate(result, app, service, expected, network, pool, vpn_service, host, p
             or not re.fullmatch(r'\d{4}-\d\d-\d\dT\d\d:\d\d:\d\dZ', result['observed_at'])):
         raise NetworkFailure('remote_invalid')
     bridge_record(result['bridge'], app, network)
-    observation_records(result)
+    observation_records(result, ipv6=':' in pool)
     host_records(result, provider)
     return result

package/backend-action/network_readback.py

@@ -26,23 +26,31 @@ def application(app, service, expected):
     return rows
 
 
-def snapshot(app, service, expected):
+def snapshot(app, service, expected, ipv6=False):
     return {'application': application(app, service, expected), 'networks': network_inventory.networks(),
-            'host': network_inventory.host_networks(), 'bindings': network_inventory.port_bindings(),
+            'host': network_inventory.host_networks(include_ipv6=ipv6), 'bindings': network_inventory.port_bindings(),
             'listeners': network_host.listeners()}
 
 
 def collect(app, service, expected, network, pool, vpn_service, host, provider):
     scope(app, service, expected, network, pool, vpn_service, host, provider)
     network_host.local_docker()
-    original = snapshot(app, service, expected)
+    ipv6 = ':' in pool
+    original = snapshot(app, service, expected, ipv6=ipv6)
     bridge = network_inventory.selected(original['networks'], app, network)
     host_result = network_metadata.observe(host, original['host'], provider)
     firewall, masquerade, netfilter = network_host.firewall(bridge)
     namespace = network_host.namespace(original['application'], app, vpn_service, bridge)
     namespace.update(netfilter_nat_read=netfilter, selected_bridge_masquerade=masquerade)
-    if snapshot(app, service, expected) != original:
+    safe = namespace['vpn_settings'] == 'isolated_net_admin'
+    routes = network_host.ipv6_routes(original['application'], app, vpn_service, bridge,
+                                      namespace_safe=safe) if ipv6 else None
+    if (snapshot(app, service, expected, ipv6=ipv6) != original
+            or ipv6 and network_host.ipv6_routes(original['application'], app, vpn_service, bridge,
+                                                  namespace_safe=safe) != routes):
         raise NetworkFailure('network_changed')
+    if routes is not None:
+        namespace.update(routes)
     result = dict(envelope(app, service, expected, network, pool, vpn_service, host, provider),
         observed_build_sha=expected, bridge=bridge, host=host_result, firewall=firewall, namespace=namespace,
         overlap=network_inventory.overlap(original['networks'], bridge, original['host'], pool),

package/docs/BACKEND_SSH_GATE.md

@@ -107,7 +107,7 @@ shared-database substitution.
 `operation: network-diagnostics` is a read-only operation. The network allocator remains retired.
 Select `diagnostic-service` (the existing API), `diagnostic-network` (the existing Compose bridge key,
 default `default`), `diagnostic-vpn-service` (default `vpn`), `expected-build-sha`, and `diagnostic-pool`:
-a strict RFC1918 IPv4 `/24` proposed only for the VPN container namespace. It creates no address reservation,
+a strict RFC1918 IPv4 `/24` or IPv6 ULA `/64` proposed only for the VPN container namespace. It creates no reservation,
 network, route, firewall rule, container, certificate or service. Do not use this pool as Compose IPAM.
 The generated workflow transports `diagnostic-build-sha` separately so a workflow-only commit can inspect
 the API build actually deployed, rather than claiming its own checkout SHA is running.
@@ -123,7 +123,7 @@ released `network_readback.py`. It accepts no uploaded Python or app-mirror help
 alone cannot install this host operation: install the integrity-verified published runtime first. A missing
 host reader returns `network_reader_unavailable` with no host reader version; it is not a network verdict.
 
-The closed `gowalk-cicd/backend-network-diagnostics.v3` result is retained as
+The closed `gowalk-cicd/backend-network-diagnostics.v3` IPv4 result, or `v4` for IPv6, is retained as
 `backend-network-diagnostics-<job>-<attempt>/result.json`. `ok: true` means the bounded read completed;
 it never means a VPN is provisioned, traffic is reachable, a pool is globally unused or a tunnel works.
 The reader binds the existing API's `BUILD_SHA`, checks its exact project/service/directory labels, and
@@ -150,12 +150,17 @@ for client compatibility, so prove adoption with the install receipt and the for
   only NET_ADMIN plus optional NET_BIND_SERVICE/CHOWN/SETUID/SETGID/SETPCAP for bootstrap and privilege dropping,
   and namespace-only forwarding/redirect settings. This observes grants, not that a daemon actually dropped privileges.
   An absent VPN reports `absent`; these observations do not test creating a namespace or applying capabilities.
+- An IPv6 request additionally compares the proposed ULA against host IPv6 routes, addresses and Docker subnets.
+  It reports host and owned-gateway IPv6 default-route and forwarding observations independently; missing tools or
+  inaccessible namespaces remain `unverified`, and an absent gateway reports `not_running`. A default route is not
+  a usable Internet path: `ipv6_external_connectivity` stays `unverified` until an independent traffic exercise.
 - `firewall` reports observed INPUT/FORWARD policies and explicit UDP ACCEPT rules. Effective ingress
   remains `unverified`: chained rules, nftables and upstream/provider firewalls need actual external traffic proof.
 
 Foreign network ownership/configuration, process identities, raw firewall rules, environment values and
 private bindings never leave the host. Foreign subnet data is used privately only to calculate overlap flags.
-The reader executes no container code, reads no logs and contacts no provider management API.
+The IPv6 reader enters only the verified owned container's Docker network namespace using host `ip` and `cat`; it
+executes no container code, reads no logs and contacts no provider management API.
 No retry, downgrade, unrestricted SSH or historical inventory can replace a refused current read.
 Preserve bridge and database identities, assess the observations within their stated scope, then separately
 verify the actual namespaced gateway configuration, IKEv2 negotiation and encrypted forwarded traffic.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.207",
+  "version": "1.0.208",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy-backend.yml

@@ -37,7 +37,7 @@ on:
         required: false
       diagnostic-pool:
         type: string
-        description: Proposed namespace-only VPN private IPv4 /24
+        description: Proposed namespace-only VPN private IPv4 /24 or IPv6 ULA /64
         required: false
       diagnostic-network:
         type: string