summaryrefslogtreecommitdiff
path: root/tests/binder_test.cpp
diff options
context:
space:
mode:
Diffstat (limited to 'tests/binder_test.cpp')
-rw-r--r--tests/binder_test.cpp13
1 files changed, 8 insertions, 5 deletions
diff --git a/tests/binder_test.cpp b/tests/binder_test.cpp
index 22d1f226..e80296a5 100644
--- a/tests/binder_test.cpp
+++ b/tests/binder_test.cpp
@@ -2420,11 +2420,14 @@ void expectFirewallAllowlistMode() {
}
void expectFirewallDenylistMode() {
- for (const auto& binary : {IPTABLES_PATH, IP6TABLES_PATH}) {
- EXPECT_EQ(2, iptablesRuleLineLength(binary, FIREWALL_INPUT));
- EXPECT_EQ(2, iptablesRuleLineLength(binary, FIREWALL_OUTPUT));
- EXPECT_EQ(2, iptablesRuleLineLength(binary, FIREWALL_FORWARD));
- }
+ EXPECT_EQ(2, iptablesRuleLineLength(IPTABLES_PATH, FIREWALL_INPUT));
+ EXPECT_EQ(2, iptablesRuleLineLength(IPTABLES_PATH, FIREWALL_OUTPUT));
+ EXPECT_EQ(2, iptablesRuleLineLength(IPTABLES_PATH, FIREWALL_FORWARD));
+
+ // for IPv6 there is an extra OUTPUT rule to DROP ::1 sourced packets to non-loopback devices
+ EXPECT_EQ(2, iptablesRuleLineLength(IP6TABLES_PATH, FIREWALL_INPUT));
+ EXPECT_EQ(3, iptablesRuleLineLength(IP6TABLES_PATH, FIREWALL_OUTPUT));
+ EXPECT_EQ(2, iptablesRuleLineLength(IP6TABLES_PATH, FIREWALL_FORWARD));
}
bool iptablesFirewallInterfaceFirstRuleExists(const char* binary, const char* chainName,