diff options
| author | Maciej Żenczykowski <maze@google.com> | 2021-10-14 20:22:23 -0700 |
|---|---|---|
| committer | Maciej Żenczykowski <maze@google.com> | 2021-10-15 08:42:43 +0000 |
| commit | 344bb894d2dbdffcd1635685e6dce32bfd35206b (patch) | |
| tree | 8989500b52086b2908dbc0054097bbc3987dde5f /server/FirewallControllerTest.cpp | |
| parent | 2b0b5ec491178708a0da8550088ba57ebe4a9a88 (diff) | |
Never send packets with a source of ::1 on the wire.
Doing so is obviously invalid, and certain carriers will tear
down the connection if such packets are sent on their network.
This is done by adding an ip6tables rule to fw_OUTPUT that drops
all packets with a non-lo egress interface and a source of ::1.
Test: boot device, "adb root && adb shell ip6tables-save | egrep fw_OUTPUT"
Bug: 190368103
Bug: 198896920
Bug: 203096965
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ifb272d48705ba756ccd7bac806e4dc2dd7488cd5
Diffstat (limited to 'server/FirewallControllerTest.cpp')
| -rw-r--r-- | server/FirewallControllerTest.cpp | 23 |
1 files changed, 11 insertions, 12 deletions
diff --git a/server/FirewallControllerTest.cpp b/server/FirewallControllerTest.cpp index df6ca82d..1f199af6 100644 --- a/server/FirewallControllerTest.cpp +++ b/server/FirewallControllerTest.cpp @@ -227,19 +227,18 @@ TEST_F(FirewallControllerTest, TestEnableChildChains) { TEST_F(FirewallControllerTest, TestFirewall) { std::vector<std::string> enableCommands = { - "*filter\n" - "-A fw_INPUT -j DROP\n" - "-A fw_OUTPUT -j REJECT\n" - "-A fw_FORWARD -j REJECT\n" - "COMMIT\n" - }; + "*filter\n" + "-A fw_INPUT -j DROP\n" + "-A fw_OUTPUT -j REJECT\n" + "-A fw_FORWARD -j REJECT\n" + "COMMIT\n"}; std::vector<std::string> disableCommands = { - "*filter\n" - ":fw_INPUT -\n" - ":fw_OUTPUT -\n" - ":fw_FORWARD -\n" - "COMMIT\n" - }; + "*filter\n" + ":fw_INPUT -\n" + ":fw_OUTPUT -\n" + ":fw_FORWARD -\n" + "-6 -A fw_OUTPUT ! -o lo -s ::1 -j DROP\n" + "COMMIT\n"}; std::vector<std::string> noCommands = {}; EXPECT_EQ(0, mFw.resetFirewall()); |