ci: permit only the exact local emulator

Author: BitHighlander

.github/workflows/ci.yml

@@ -103,9 +103,15 @@ jobs:
         run: |
           cd tests
           python tx_fixture_manifest.py --check
-          sudo iptables -I OUTPUT 1 ! -o lo -m conntrack --ctstate NEW -j REJECT
+          EMULATOR_IP=$(docker inspect -f \
+            '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' \
+            "${{ job.services.kkemu.id }}")
+          test -n "$EMULATOR_IP"
+          sudo iptables -I OUTPUT 1 -d "$EMULATOR_IP" -j ACCEPT
+          sudo iptables -I OUTPUT 2 ! -o lo -m conntrack --ctstate NEW -j REJECT
           cleanup_network_gate() {
             sudo iptables -D OUTPUT ! -o lo -m conntrack --ctstate NEW -j REJECT
+            sudo iptables -D OUTPUT -d "$EMULATOR_IP" -j ACCEPT
           }
           trap cleanup_network_gate EXIT
           pytest -v --junitxml=junit.xml 2>&1 | tee pytest-output.txt

docs/handoff-python-test-hermeticity.md

@@ -35,9 +35,9 @@ Affected surfaces:
   mode for every KeepKeyTest.
 - tests/conftest.py rejects external DNS, socket, and HTTP access per test while
   permitting only loopback emulator traffic and Unix-domain sockets.
-- .github/workflows/ci.yml checks fixture integrity, adds a kernel outbound-new-
-  connection deny rule during authoritative pytest, and records the manifest
-  SHA-256 in every summary.
+- .github/workflows/ci.yml checks fixture integrity, permits the exact local
+  emulator container IP, rejects every other new non-loopback connection during
+  authoritative pytest, and records the manifest SHA-256 in every summary.
 - tests/tx_fixture_manifest.py and tests/test_tx_fixture_integrity.py account
   for every fixture, reconstruct canonical transactions, recompute every txid,
   test cwd independence and fail-closed misses, and statically reject new