ci: permit only exact emulator containers

Author: BitHighlander

.github/workflows/ci.yml

@@ -253,9 +253,14 @@ jobs:
           # claiming the sources are missing.
           cd keepkey-firmware/deps/python-keepkey/tests
           python tx_fixture_manifest.py --check
-          sudo iptables -I OUTPUT 1 ! -o lo -m conntrack --ctstate NEW -j REJECT
+          EMULATOR_IP=$(docker inspect -f \
+            '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' kkemu)
+          test -n "$EMULATOR_IP"
+          sudo iptables -I OUTPUT 1 -d "$EMULATOR_IP" -j ACCEPT
+          sudo iptables -I OUTPUT 2 ! -o lo -m conntrack --ctstate NEW -j REJECT
           cleanup_network_gate() {
             sudo iptables -D OUTPUT ! -o lo -m conntrack --ctstate NEW -j REJECT
+            sudo iptables -D OUTPUT -d "$EMULATOR_IP" -j ACCEPT
           }
           trap cleanup_network_gate EXIT
           pytest -v --junitxml=junit.xml 2>&1 | tee pytest-output.txt
@@ -468,9 +473,14 @@ jobs:
         run: |
           cd keepkey-firmware/deps/python-keepkey/tests
           python tx_fixture_manifest.py --check
-          sudo iptables -I OUTPUT 1 ! -o lo -m conntrack --ctstate NEW -j REJECT
+          EMULATOR_IP=$(docker inspect -f \
+            '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' kkemu-rc18)
+          test -n "$EMULATOR_IP"
+          sudo iptables -I OUTPUT 1 -d "$EMULATOR_IP" -j ACCEPT
+          sudo iptables -I OUTPUT 2 ! -o lo -m conntrack --ctstate NEW -j REJECT
           cleanup_network_gate() {
             sudo iptables -D OUTPUT ! -o lo -m conntrack --ctstate NEW -j REJECT
+            sudo iptables -D OUTPUT -d "$EMULATOR_IP" -j ACCEPT
           }
           trap cleanup_network_gate EXIT
           pytest -v --junitxml=junit-rc18.xml 2>&1 | tee pytest-rc18-output.txt
@@ -689,9 +699,14 @@ jobs:
         run: |
           cd keepkey-firmware/deps/python-keepkey/tests
           python tx_fixture_manifest.py --check
-          sudo iptables -I OUTPUT 1 ! -o lo -m conntrack --ctstate NEW -j REJECT
+          EMULATOR_IP=$(docker inspect -f \
+            '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' kkemu-btc)
+          test -n "$EMULATOR_IP"
+          sudo iptables -I OUTPUT 1 -d "$EMULATOR_IP" -j ACCEPT
+          sudo iptables -I OUTPUT 2 ! -o lo -m conntrack --ctstate NEW -j REJECT
           cleanup_network_gate() {
             sudo iptables -D OUTPUT ! -o lo -m conntrack --ctstate NEW -j REJECT
+            sudo iptables -D OUTPUT -d "$EMULATOR_IP" -j ACCEPT
           }
           trap cleanup_network_gate EXIT
           pytest -v --junitxml=junit-btc.xml test_msg_bitcoin_only_variant.py \

docs/handoff-python-test-hermeticity.md

@@ -30,9 +30,9 @@ Affected surfaces:
   mode for every KeepKeyTest.
 - tests/conftest.py rejects external DNS, socket, and HTTP access per test while
   permitting only loopback emulator traffic and Unix-domain sockets.
-- .github/workflows/ci.yml checks fixture integrity, adds a kernel outbound-new-
-  connection deny rule during authoritative pytest, and records the manifest
-  SHA-256 in every summary.
+- .github/workflows/ci.yml checks fixture integrity, permits the exact local
+  emulator container IP, rejects every other new non-loopback connection during
+  authoritative pytest, and records the manifest SHA-256 in every summary.
 - tests/tx_fixture_manifest.py and tests/test_tx_fixture_integrity.py account
   for every fixture, reconstruct canonical transactions, recompute every txid,
   test cwd independence and fail-closed misses, and statically reject new