#31349 ci: detect outbound internet traffic generated while running tests

• Detect unexpected outbound network traffic and DNS lookups generated while running tests in CI
• Prevent tests from violating test isolation and leaking developer IP addresses

This pull request configures the CI environment to detect unexpected outbound TCP and UDP traffic (as well as DNS lookups) generated during test execution. It runs background tcpdump monitors across interfaces during unit, functional, fuzz, and tidy runs, failing the build if non-loopback network packets are generated.

Problem: Tests occasionally attempt real outbound network connections or DNS queries (such as seed lookups, NAT-PMP requests, or system debug services), which leak developer IP addresses and violate test isolation.

P3 · test coverage

• P3 because it improves CI signal and hermeticity by failing builds on outbound network leaks
• Prevents future pull requests from introducing network-leaking tests without fixing a broken build

P3 because it improves CI signal and test hermeticity by preventing future PRs from inadvertently introducing network-leaking tests. While valuable for developer privacy and CI discipline, it does not fix a broken build or platform failure.

Membership: Modifies CI setup and execution scripts in ci/test/ to configure packet capture and fail CI on non-loopback network traffic.

Factors: security/stability 1, bug 1, performance 0, user value 1, leverage 1

P3 · test coverage

• P3 because it verifies that test suites remain strictly hermetic without contacting external servers
• Protects developer privacy during test runs, though it does not resolve test framework blockers

P3 because it provides a mechanism to verify that tests remain hermetic and do not touch external servers. It solves an acknowledged privacy issue for developers running tests, but it does not fix functional or unit test framework blockers.

Membership: Adds verification harness across the test runners to enforce that test suites do not produce outbound network traffic.

Factors: security/stability 1, bug 1, performance 0, user value 1, leverage 1

• Author has been silent for over 90 days with an unanswered technical comment

The author has been silent for 91 days, exceeding the 60-day threshold, and an open technical review comment from fjahr on 2026-08-28 remains unanswered.

Author status: silent since 2026-06-18

Open concerns:

• fjahr noted that tcpdump's --direction option is only enforced during packet capture, making its use when reading capture files a no-op that needs adjusting.
• Past friction from fanquake and maflcko regarding non-deterministic failures and false positives when running CI scripts locally via podman.

Resolved concerns:

• Specific unit test network leak in node_init_tests was extracted and fixed in #35193.
• DNS seed lookups causing spurious alerts were mitigated by running unit tests with -dnsseed=0.
• Shellcheck warnings on variable assignments in CI scripts were fixed.

• Broad concept agreement on catching unexpected network traffic in CI (laanwj, jonatack, sipa, Sjors)
• Approvals on earlier revisions (ryanofsky, 0xB10C, fjahr)
• Unaddressed technical comment: tcpdump direction flag is a no-op when reading capture files (fjahr)
• Concern about false positives and failures when running CI scripts locally under Podman (fanquake, maflcko)

Strong concept agreement, but open technical comment from fjahr and past concerns over local podman failures

There is broad agreement on the value of catching network traffic in CI, and ryanofsky and fjahr previously ACKed. However, fjahr has an open comment regarding improper flag usage with tcpdump, and reviewers have raised recurring concerns about local CI reproducibility.

• Concept ACKs from laanwj, jonatack, sipa, Sjors, and 1440000bytes.
• Approvals on earlier revisions from ryanofsky, 0xB10C, and fjahr.
• fanquake and maflcko reported failures when running the CI scripts locally under Podman.
• fjahr noted on 2026-08-28 that '--direction is only enforced at capture time' and is a no-op when reading.

Review verdicts (DrahtBot): 0 (+3)

• Stale ACK: 0xB10C, fjahr, ryanofsky
• Concept ACK: laanwj, jonatack, BrandonOdiwuor, sipa, Sjors, 1440000bytes, maflcko

79 lines under test/bench/ci.

• ci/test/03_test_script.sh +70/-0
• ci/test/00_setup_env.sh +1/-1
• ci/test/00_setup_env_mac_native.sh +2/-0
• ci/test/00_setup_env_mac_native_fuzz.sh +2/-0
• ci/test/00_setup_env_native_alpine_musl.sh +1/-1
• ci/test/02_run_container.py +1/-0

This PR integrates tcpdump into the CI test runners to detect and fail on outbound network traffic or DNS queries generated while running tests. It addresses privacy concerns where developers' IP addresses are exposed when tests inadvertently query external DNS seeds or peers. Concept approval is solid across multiple contributors, but the PR is currently stale following 91 days of author inactivity and an unaddressed comment from fjahr regarding tcpdump flag usage. It remains a worthwhile (P3) improvement to test isolation in CI.