test: fail on hidden offline egress

Count cgroup-scoped firewall rejects and fail the offline test harness with bounded aggregate diagnostics. Inject the gen-audio GGUF probe so fixture-backed importer tests do not attempt real network access.

Assisted-by: Codex:gpt-5
Signed-off-by: Richard Palethorpe <io@richiejp.com>

Author: richiejp

core/gallery/importers/importers_suite_test.go

@@ -65,7 +65,11 @@ var _ = BeforeSuite(func() {
 	restoreMTP := importers.SetMTPProbeForTest(func(context.Context, string) (*gguf.GGUFFile, error) {
 		return nil, errors.New("remote GGUF probing disabled in fixture-backed importer tests")
 	})
+	restoreGenAudio := importers.SetGenAudioProbeForTest(func(context.Context, string) (*gguf.GGUFFile, error) {
+		return nil, errors.New("remote GGUF probing disabled in fixture-backed importer tests")
+	})
 	DeferCleanup(func() {
+		restoreGenAudio()
 		restoreMTP()
 		restoreMetadata()
 	})

core/gallery/importers/llama-cpp.go

@@ -24,6 +24,9 @@ var (
 	parseRemoteGGUF                            = func(ctx context.Context, url string) (*gguf.GGUFFile, error) {
 		return gguf.ParseGGUFFileRemote(ctx, url, gguf.SkipLargeMetadata())
 	}
+	parseRemoteGenAudioGGUF = func(ctx context.Context, url string) (*gguf.GGUFFile, error) {
+		return gguf.ParseGGUFFileRemote(ctx, url)
+	}
 )
 
 // SetMTPProbeForTest replaces the remote GGUF header reader and returns a
@@ -34,6 +37,14 @@ func SetMTPProbeForTest(probe func(context.Context, string) (*gguf.GGUFFile, err
 	return func() { parseRemoteGGUF = previous }
 }
 
+// SetGenAudioProbeForTest replaces the remote projector header reader and
+// returns a restore function. It must only be called during serial suite setup.
+func SetGenAudioProbeForTest(probe func(context.Context, string) (*gguf.GGUFFile, error)) func() {
+	previous := parseRemoteGenAudioGGUF
+	parseRemoteGenAudioGGUF = probe
+	return func() { parseRemoteGenAudioGGUF = previous }
+}
+
 type LlamaCPPImporter struct{}
 
 func (i *LlamaCPPImporter) Name() string      { return "llama-cpp" }
@@ -465,7 +476,7 @@ func maybeApplyTTSUsecase(modelConfig *config.ModelConfig, cfg *gallery.ModelCon
 		}
 	}()
 
-	f, err := gguf.ParseGGUFFileRemote(ctx, probeURL)
+	f, err := parseRemoteGenAudioGGUF(ctx, probeURL)
 	if err != nil {
 		xlog.Debug("[tts-importer] failed to read remote mmproj header for gen-audio detection", "uri", probeURL, "error", err)
 		return

scripts/run-test-linux-offline.sh

@@ -15,28 +15,56 @@ root=$(cd "$(dirname "$0")/.." && pwd)
 group="localai-test-$$"
 cgroup="/sys/fs/cgroup/$group"
 parent_cgroup="/sys/fs/cgroup$(awk -F: '$1 == "0" {print $3}' /proc/self/cgroup)"
+chain="LAI_TEST_$$"
 
 sudo mkdir "$cgroup"
 cleanup() {
   echo $$ | sudo tee "$parent_cgroup/cgroup.procs" >/dev/null 2>&1 || true
-  sudo iptables -D OUTPUT -m cgroup --path "$group" -j REJECT 2>/dev/null || true
-  sudo iptables -D OUTPUT -m cgroup --path "$group" -d 192.168.0.0/16 -j ACCEPT 2>/dev/null || true
-  sudo iptables -D OUTPUT -m cgroup --path "$group" -d 172.16.0.0/12 -j ACCEPT 2>/dev/null || true
-  sudo iptables -D OUTPUT -m cgroup --path "$group" -d 10.0.0.0/8 -j ACCEPT 2>/dev/null || true
-  sudo iptables -D OUTPUT -m cgroup --path "$group" -d 127.0.0.0/8 -j ACCEPT 2>/dev/null || true
-  sudo ip6tables -D OUTPUT -m cgroup --path "$group" -d ::1/128 -j ACCEPT 2>/dev/null || true
-  sudo ip6tables -D OUTPUT -m cgroup --path "$group" -j REJECT 2>/dev/null || true
+  sudo iptables -D OUTPUT -m cgroup --path "$group" -j "$chain" 2>/dev/null || true
+  sudo iptables -F "$chain" 2>/dev/null || true
+  sudo iptables -X "$chain" 2>/dev/null || true
+  sudo ip6tables -D OUTPUT -m cgroup --path "$group" -j "$chain" 2>/dev/null || true
+  sudo ip6tables -F "$chain" 2>/dev/null || true
+  sudo ip6tables -X "$chain" 2>/dev/null || true
   sudo rmdir "$cgroup" 2>/dev/null || true
 }
 trap cleanup EXIT INT TERM
 
-sudo iptables -I OUTPUT 1 -m cgroup --path "$group" -j REJECT
-sudo iptables -I OUTPUT 1 -m cgroup --path "$group" -d 192.168.0.0/16 -j ACCEPT
-sudo iptables -I OUTPUT 1 -m cgroup --path "$group" -d 172.16.0.0/12 -j ACCEPT
-sudo iptables -I OUTPUT 1 -m cgroup --path "$group" -d 10.0.0.0/8 -j ACCEPT
-sudo iptables -I OUTPUT 1 -m cgroup --path "$group" -d 127.0.0.0/8 -j ACCEPT
-sudo ip6tables -I OUTPUT 1 -m cgroup --path "$group" -j REJECT
-sudo ip6tables -I OUTPUT 1 -m cgroup --path "$group" -d ::1/128 -j ACCEPT
+sudo iptables -N "$chain"
+sudo iptables -A "$chain" -d 127.0.0.0/8 -j ACCEPT
+sudo iptables -A "$chain" -d 10.0.0.0/8 -j ACCEPT
+sudo iptables -A "$chain" -d 172.16.0.0/12 -j ACCEPT
+sudo iptables -A "$chain" -d 192.168.0.0/16 -j ACCEPT
+sudo iptables -A "$chain" -j REJECT
+sudo iptables -I OUTPUT 1 -m cgroup --path "$group" -j "$chain"
+
+sudo ip6tables -N "$chain"
+sudo ip6tables -A "$chain" -d ::1/128 -j ACCEPT
+sudo ip6tables -A "$chain" -j REJECT
+sudo ip6tables -I OUTPUT 1 -m cgroup --path "$group" -j "$chain"
 echo $$ | sudo tee "$cgroup/cgroup.procs" >/dev/null
 
+set +e
 LOCALAI_TEST_KERNEL_ACTIVE=1 "$root/scripts/run-test-offline.sh" "$@"
+command_status=$?
+set -e
+
+# The final rule in each private chain is the external-egress REJECT. Reading
+# its counter makes even an optional probe that swallows its network error a
+# hard, visible test failure. Report aggregate counters only: packet-by-packet
+# kernel logging can itself exhaust CI logs when a client retries aggressively.
+ipv4_blocked=$(sudo iptables -L "$chain" -v -x -n | awk '$3 == "REJECT" { print $1; exit }')
+ipv6_blocked=$(sudo ip6tables -L "$chain" -v -x -n | awk '$3 == "REJECT" { print $1; exit }')
+ipv4_blocked=${ipv4_blocked:-0}
+ipv6_blocked=${ipv6_blocked:-0}
+
+if (( ipv4_blocked > 0 || ipv6_blocked > 0 )); then
+  {
+    echo 'offline-test: external network access was attempted and blocked'
+    echo "offline-test: blocked packets: ipv4=$ipv4_blocked ipv6=$ipv6_blocked"
+    echo 'offline-test: replace real network clients with fixtures or injected test doubles'
+  } >&2
+  exit 1
+fi
+
+exit "$command_status"