diff --git a/gcov.sh b/gcov.sh index 0f2808ace..ef95b44b0 100755 --- a/gcov.sh +++ b/gcov.sh @@ -21,29 +21,29 @@ rm -fr gcov-dir gcov-file firejail --version gcov_generate -make test-firecfg | grep TESTING -gcov_generate -make test-apparmor | grep TESTING -gcov_generate +#make test-firecfg | grep TESTING +#gcov_generate +#make test-apparmor | grep TESTING +#gcov_generate make test-network | grep TESTING gcov_generate -make test-appimage | grep TESTING -gcov_generate -make test-chroot | grep TESTING -gcov_generate -make test-sysutils | grep TESTING -gcov_generate -make test-private-etc | grep TESTING -gcov_generate -make test-profiles | grep TESTING -gcov_generate -make test-fcopy | grep TESTING -gcov_generate +#make test-appimage | grep TESTING +#gcov_generate +#make test-chroot | grep TESTING +#gcov_generate +#make test-sysutils | grep TESTING +#gcov_generate +#make test-private-etc | grep TESTING +#gcov_generate +#make test-profiles | grep TESTING +#gcov_generate +#make test-fcopy | grep TESTING +#gcov_generate make test-fnetfilter | grep TESTING gcov_generate -make test-fs | grep TESTING -gcov_generate -make test-utils | grep TESTING -gcov_generate -make test-environment | grep TESTING -gcov_generate +#make test-fs | grep TESTING +#gcov_generate +#make test-utils | grep TESTING +#gcov_generate +#make test-environment | grep TESTING +#gcov_generate diff --git a/src/firejail/netfilter.c b/src/firejail/netfilter.c index b4deda562..32fdd6218 100644 --- a/src/firejail/netfilter.c +++ b/src/firejail/netfilter.c @@ -248,5 +248,5 @@ void netfilter_print(pid_t pid, int ipv6) { exit(1); } - sbox_run(SBOX_ROOT | SBOX_CAPS_NETWORK | SBOX_SECCOMP, 2, iptables, "-vL"); + sbox_run(SBOX_ROOT | SBOX_CAPS_NETWORK | SBOX_SECCOMP, 2, iptables, "-nvL"); } diff --git a/test/network/net_netfilter.exp b/test/network/net_netfilter.exp index 56480251e..ac144e19d 100755 --- a/test/network/net_netfilter.exp +++ b/test/network/net_netfilter.exp @@ -20,7 +20,27 @@ spawn $env(SHELL) send -- "firejail --netfilter.print=test\r" expect { timeout {puts "TESTING ERROR 1\n";exit} - "ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED" + "ACCEPT" +} +expect { + timeout {puts "TESTING ERROR 1\n";exit} + "lo" +} +expect { + timeout {puts "TESTING ERROR 1\n";exit} + "ACCEPT" +} +expect { + timeout {puts "TESTING ERROR 1\n";exit} + "state RELATED,ESTABLISHED" +} +expect { + timeout {puts "TESTING ERROR 1\n";exit} + "ACCEPT" +} +expect { + timeout {puts "TESTING ERROR 1\n";exit} + "icmptype 8" } after 500 diff --git a/test/network/network.sh b/test/network/network.sh index e062358d4..2a7de2680 100755 --- a/test/network/network.sh +++ b/test/network/network.sh @@ -39,8 +39,8 @@ echo "TESTING: bandwidth (net_bandwidth.exp)" echo "TESTING: ipv6 (ip6.exp)" ./ip6.exp -#echo "TESTING: ipv6 netfilter(ip6_netfilter.exp)" -#./ip6_netfilter.exp +echo "TESTING: ipv6 netfilter(ip6_netfilter.exp)" +./ip6_netfilter.exp sudo ip link set br0 down sudo brctl delbr br0