ci: detect outbound internet traffic generated while running tests

Resolves bitcoin#31339

Author: vasild

ci/test/00_setup_env.sh

@@ -64,7 +64,7 @@ export BASE_OUTDIR=${BASE_OUTDIR:-$BASE_SCRATCH_DIR/out}
 # The folder for previous release binaries.
 # This folder exists only on the ci guest, and on the ci host as a volume.
 export PREVIOUS_RELEASES_DIR=${PREVIOUS_RELEASES_DIR:-$BASE_ROOT_DIR/prev_releases}
-export CI_BASE_PACKAGES=${CI_BASE_PACKAGES:-build-essential pkgconf curl ca-certificates ccache python3 rsync git procps bison e2fsprogs cmake ninja-build}
+export CI_BASE_PACKAGES=${CI_BASE_PACKAGES:-build-essential pkgconf curl ca-certificates ccache python3 rsync git procps bison e2fsprogs cmake ninja-build net-tools tcpdump}
 export GOAL=${GOAL:-install}
 export DIR_QA_ASSETS=${DIR_QA_ASSETS:-${BASE_SCRATCH_DIR}/qa-assets}
 export CI_RETRY_EXE=${CI_RETRY_EXE:-"retry --"}

ci/test/00_setup_env_mac_native.sh

@@ -17,3 +17,5 @@ export CI_OS_NAME="macos"
 export NO_DEPENDS=1
 export OSX_SDK=""
 export BITCOIN_CMD="bitcoin -m" # Used in functional tests
+# Can't run tcpdump: tcpdump: en0: You don't have permission to capture on that device
+export CI_TCPDUMP_OK_TO_FAIL=1

ci/test/00_setup_env_mac_native_fuzz.sh

@@ -16,3 +16,5 @@ export RUN_UNIT_TESTS=false
 export RUN_FUNCTIONAL_TESTS=false
 export RUN_FUZZ_TESTS=true
 export GOAL="all"
+# Can't run tcpdump: tcpdump: en0: You don't have permission to capture on that device
+export CI_TCPDUMP_OK_TO_FAIL=1

ci/test/00_setup_env_native_centos.sh

@@ -8,7 +8,7 @@ export LC_ALL=C.UTF-8
 
 export CONTAINER_NAME=ci_native_centos
 export CI_IMAGE_NAME_TAG="quay.io/centos/centos:stream10"
-export CI_BASE_PACKAGES="gcc-c++ glibc-devel libstdc++-devel ccache make ninja-build git python3 python3-pip which patch xz procps-ng rsync coreutils bison e2fsprogs cmake dash"
+export CI_BASE_PACKAGES="gcc-c++ glibc-devel libstdc++-devel ccache make ninja-build git python3 python3-pip which patch xz procps-ng rsync coreutils bison e2fsprogs cmake dash net-tools tcpdump"
 export PIP_PACKAGES="pyzmq pycapnp"
 export DEP_OPTS="DEBUG=1"
 export GOAL="install"

ci/test/02_run_container.sh

@@ -86,7 +86,7 @@ if [ -z "$DANGER_RUN_CI_ON_HOST" ]; then
   docker image prune --force --filter "label=$CI_IMAGE_LABEL"
 
   # shellcheck disable=SC2086
-  CI_CONTAINER_ID=$(docker run --cap-add LINUX_IMMUTABLE $CI_CONTAINER_CAP --rm --interactive --detach --tty \
+  CI_CONTAINER_ID=$(docker run --cap-add LINUX_IMMUTABLE --cap-add NET_RAW $CI_CONTAINER_CAP --rm --interactive --detach --tty \
                   --mount "type=bind,src=$BASE_READ_ONLY_DIR,dst=$BASE_READ_ONLY_DIR,readonly" \
                   --mount "${CI_CCACHE_MOUNT}" \
                   --mount "${CI_DEPENDS_MOUNT}" \

ci/test/03_test_script.sh

@@ -167,17 +167,65 @@ if [ "$RUN_CHECK_DEPS" = "true" ]; then
   "${BASE_ROOT_DIR}/contrib/devtools/check-deps.sh" "${BASE_BUILD_DIR}"
 fi
 
+function get_interfaces()
+{
+  set -o pipefail
+  ifconfig | awk -F ':| ' '/^[^[:space:]]/ { if (!match($1, /^lo/)) { print $1 } }'
+  set +o pipefail
+}
+
+function tcpdump_file()
+{
+  echo "/tmp/tcpdump_$1_$2"
+}
+
+function traffic_monitor_begin()
+{
+  test_name="$1"
+  for ifname in $(get_interfaces) ; do
+    tcpdump -nU -i "$ifname" -w "$(tcpdump_file "$test_name" "$ifname")" &
+  done
+}
+
+function traffic_monitor_end()
+{
+  test_name="$1"
+
+  for ifname in $(get_interfaces) ; do
+    f=$(tcpdump_file "$test_name" "$ifname")
+    if [ ! -e "$f" ] && [ "$CI_TCPDUMP_OK_TO_FAIL" = "1" ] ; then
+      # In some CI environments this script is not running as root and so the
+      # tcpdump errors and does not create $f. Skip silently those, but we
+      # need at least one where tcpdump can run and this is the ASAN one. So
+      # treat the absence of $f as an error only on the ASAN task.
+      continue
+    fi
+    # We are running as root and those files are created with owner:group =
+    # tcpdump:tcpdump and then `tcpdump -r` refuses to read them with an error
+    # "permission denied" if they are not owned by root:root.
+    chown root:root "$f"
+    out="$(tcpdump -n -r "$f" --direction=out tcp or udp)"
+    if [ -n "$out" ] ; then
+      echo "Error: outbound TCP or UDP packets on the non loopback interface generated during $test_name tests:" >&2
+      tcpdump -n -r "$f" tcp or udp
+    fi
+  done
+}
+
 if [ "$RUN_UNIT_TESTS" = "true" ]; then
+  traffic_monitor_begin "unit"
   DIR_UNIT_TEST_DATA="${DIR_UNIT_TEST_DATA}" \
   LD_LIBRARY_PATH="${DEPENDS_DIR}/${HOST}/lib" \
   CTEST_OUTPUT_ON_FAILURE=ON \
   ctest --test-dir "${BASE_BUILD_DIR}" \
     --stop-on-failure \
     "${MAKEJOBS}" \
     --timeout $(( TEST_RUNNER_TIMEOUT_FACTOR * 60 ))
+  traffic_monitor_end "unit"
 fi
 
 if [ "$RUN_FUNCTIONAL_TESTS" = "true" ]; then
+  traffic_monitor_begin "functional"
   # parses TEST_RUNNER_EXTRA as an array which allows for multiple arguments such as TEST_RUNNER_EXTRA='--exclude "rpc_bind.py --ipv6"'
   eval "TEST_RUNNER_EXTRA=($TEST_RUNNER_EXTRA)"
   LD_LIBRARY_PATH="${DEPENDS_DIR}/${HOST}/lib" \
@@ -190,9 +238,11 @@ if [ "$RUN_FUNCTIONAL_TESTS" = "true" ]; then
     "${TEST_RUNNER_EXTRA[@]}" \
     --quiet \
     --failfast
+  traffic_monitor_end "functional"
 fi
 
 if [ "${RUN_TIDY}" = "true" ]; then
+  traffic_monitor_begin "tidy"
   cmake -B /tidy-build -DLLVM_DIR=/usr/lib/llvm-"${TIDY_LLVM_V}"/cmake -DCMAKE_BUILD_TYPE=Release -S "${BASE_ROOT_DIR}"/contrib/devtools/bitcoin-tidy
   cmake --build /tidy-build "$MAKEJOBS"
   cmake --build /tidy-build --target bitcoin-tidy-tests "$MAKEJOBS"
@@ -219,9 +269,11 @@ if [ "${RUN_TIDY}" = "true" ]; then
   cd "${BASE_ROOT_DIR}/src"
   python3 "/include-what-you-use/fix_includes.py" --nosafe_headers < /tmp/iwyu_ci.out
   git --no-pager diff
+  traffic_monitor_end "tidy"
 fi
 
 if [ "$RUN_FUZZ_TESTS" = "true" ]; then
+  traffic_monitor_begin "fuzz"
   # shellcheck disable=SC2086
   LD_LIBRARY_PATH="${DEPENDS_DIR}/${HOST}/lib" \
   "${BASE_BUILD_DIR}/test/fuzz/test_runner.py" \
@@ -230,4 +282,5 @@ if [ "$RUN_FUZZ_TESTS" = "true" ]; then
     -l DEBUG \
     "${DIR_FUZZ_IN}" \
     --empty_min_time=60
+  traffic_monitor_end "fuzz"
 fi