test: block external DNS before resolution

Merge reviewed offline DNS guard and regression coverage.

Author: jacob-bd

tests/conftest.py

@@ -6,6 +6,7 @@
 
 from __future__ import annotations
 
+from ipaddress import ip_address
 import socket
 from unittest.mock import MagicMock, patch
 
@@ -51,14 +52,39 @@ def block_all_network(request: pytest.FixtureRequest):
         return
 
     orig_connect = socket.socket.connect
+    orig_getaddrinfo = socket.getaddrinfo
+
+    def is_allowed_host(host) -> bool:
+        if host is None:
+            return True
+        if isinstance(host, bytes):
+            try:
+                host = host.decode("ascii")
+            except UnicodeDecodeError:
+                return False
+        if host == "localhost":
+            return True
+        try:
+            address = ip_address(host)
+        except (TypeError, ValueError):
+            return False
+        return address.is_loopback or address.is_unspecified
 
     def guarded_connect(self, address, *args, **kwargs):
         host = address[0] if isinstance(address, (tuple, list)) else address
-        if host in ("127.0.0.1", "localhost", "::1"):
+        if is_allowed_host(host):
             return orig_connect(self, address, *args, **kwargs)
         raise RuntimeError(f"Blocked unmocked external network connection to {address} during test execution.")
 
-    with patch.object(socket.socket, "connect", guarded_connect):
+    def guarded_getaddrinfo(host, port, *args, **kwargs):
+        if is_allowed_host(host):
+            return orig_getaddrinfo(host, port, *args, **kwargs)
+        raise RuntimeError(f"Blocked unmocked external network connection to {(host, port)} during test execution.")
+
+    with (
+        patch.object(socket, "getaddrinfo", guarded_getaddrinfo),
+        patch.object(socket.socket, "connect", guarded_connect),
+    ):
         yield
 
 

tests/test_test_safety.py

@@ -1,7 +1,7 @@
 """Regression coverage for the opt-in live-test safety contract."""
 
 from pathlib import Path
-from unittest.mock import MagicMock
+from unittest.mock import MagicMock, patch
 
 import conftest
 import pytest
@@ -61,6 +61,23 @@ def test_collection_does_not_skip_live_tests_after_opt_in() -> None:
     item.add_marker.assert_not_called()
 
 
+def test_network_guard_blocks_dns_before_native_resolution() -> None:
+    native_getaddrinfo = MagicMock(return_value=[])
+
+    with patch.object(conftest.socket, "getaddrinfo", native_getaddrinfo):
+        fixture = conftest.block_all_network.__wrapped__(_request(marked=False, opted_in=False))
+        next(fixture)
+        try:
+            with pytest.raises(RuntimeError, match="Blocked unmocked external network connection"):
+                conftest.socket.getaddrinfo("example.com", 443)
+            native_getaddrinfo.assert_not_called()
+
+            assert conftest.socket.getaddrinfo("localhost", 443) == []
+            native_getaddrinfo.assert_called_once_with("localhost", 443)
+        finally:
+            fixture.close()
+
+
 def test_default_subprocess_skips_marked_live_test(pytester: pytest.Pytester) -> None:
     _load_project_conftest(pytester)
     pytester.makepyfile(