From bfcb4c79bb0ee6cd03efca62d570cc3cbd0ae599 Mon Sep 17 00:00:00 2001 From: RadekSabacky Date: Wed, 19 Nov 2025 13:07:08 +0100 Subject: [PATCH] / fix test_default_reject_rule --- .../nym-node-setup/network-tunnel-manager.sh | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/scripts/nym-node-setup/network-tunnel-manager.sh b/scripts/nym-node-setup/network-tunnel-manager.sh index acd0186366..266ed03679 100644 --- a/scripts/nym-node-setup/network-tunnel-manager.sh +++ b/scripts/nym-node-setup/network-tunnel-manager.sh @@ -903,14 +903,23 @@ test_forward_chain_hook() { } test_default_reject_rule() { - echo "testing default reject rule at end of ${NYM_CHAIN}" + echo "testing default reject rule position in ${NYM_CHAIN}" - if iptables -L "$NYM_CHAIN" | grep -q "REJECT"; then - echo "default reject present in ipv4 chain" - else - echo "default reject missing in ipv4 chain" + local last_rule_v4 + last_rule_v4=$(iptables -S "$NYM_CHAIN" | awk '/^-A /{rule=$0} END{print rule}') + if [[ "$last_rule_v4" != "-A $NYM_CHAIN -j REJECT --reject-with icmp-port-unreachable" ]]; then + echo "default reject missing or not last in ipv4 chain" return 1 fi + + local last_rule_v6 + last_rule_v6=$(ip6tables -S "$NYM_CHAIN" | awk '/^-A /{rule=$0} END{print rule}') + if [[ "$last_rule_v6" != "-A $NYM_CHAIN -j REJECT --reject-with icmp6-port-unreachable" ]]; then + echo "default reject missing or not last in ipv6 chain" + return 1 + fi + + echo "default reject confirmed at end of ${NYM_CHAIN}" } exit_policy_run_tests() {