> > > > > +
> > > > +FIXTURE_VARIANT(inet)
> > > > +{
> > > > + const bool is_sandboxed;
> > > > + const struct protocol_variant prot;
> > > > +};
> > > > +
> > > > +/* clang-format off */
> > > > +FIXTURE_VARIANT_ADD(inet, no_sandbox_with_ipv4) {
> > > > + /* clang-format on */
> > > > + .is_sandboxed = false,
> > > > + .prot = {
> > > > + .domain = AF_INET,
> > > > + .type = SOCK_STREAM,
> > > > + },
> > > > +};
> > > > +
> > > > +/* clang-format off */
> > > > +FIXTURE_VARIANT_ADD(inet, sandbox_with_ipv4) {
> > > > + /* clang-format on */
> > > > + .is_sandboxed = true,
> > > > + .prot = {
> > > > + .domain = AF_INET,
> > > > + .type = SOCK_STREAM,
> > > > + },
> > > > +};
> > > > +
> > > > +/* clang-format off */
> > > > +FIXTURE_VARIANT_ADD(inet, no_sandbox_with_ipv6) {
> > > > + /* clang-format on */
> > > > + .is_sandboxed = false,
> > > > + .prot = {
> > > > + .domain = AF_INET6,
> > > > + .type = SOCK_STREAM,
> > > > + },
> > > > +};
> > > > +
> > > > +/* clang-format off */
> > > > +FIXTURE_VARIANT_ADD(inet, sandbox_with_ipv6) {
> > > > + /* clang-format on */
> > > > + .is_sandboxed = true,
> > > > + .prot = {
> > > > + .domain = AF_INET6,
> > > > + .type = SOCK_STREAM,
> > > > + },
> > > > +};
> > > > +
> > > > +FIXTURE_SETUP(inet)
> > > > +{
> > > > + const struct protocol_variant ipv4_tcp = {
> > > > + .domain = AF_INET,
> > > > + .type = SOCK_STREAM,
> > > > + };
> > > > +
> > > > + disable_caps(_metadata);
> > > > +
> > > > + ASSERT_EQ(0, set_service(&self->srv0, ipv4_tcp, 0));
> > > > + ASSERT_EQ(0, set_service(&self->srv1, ipv4_tcp, 1));
> > > > +
> > > > + setup_loopback(_metadata);
> > > > +};
> > > > +
> > > > +FIXTURE_TEARDOWN(inet)
> > > > +{
> > > > +}
> > > > +
> > > > +TEST_F(inet, port_endianness)
> > > > +{
> > > > + const struct landlock_ruleset_attr ruleset_attr = {
> > > > + .handled_access_net = LANDLOCK_ACCESS_NET_BIND_TCP |
> > > > + LANDLOCK_ACCESS_NET_CONNECT_TCP,
> > > > + };
> > > > + const struct landlock_net_service_attr bind_host_endian_p0 = {
> > > > + .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP,
> > > > + /* Host port format. */
> > > > + .port = self->srv0.port,
> > > > + };
> > > > + const struct landlock_net_service_attr connect_big_endian_p0 = {
> > > > + .allowed_access = LANDLOCK_ACCESS_NET_CONNECT_TCP,
> > > > + /* Big endian port format. */
> > > > + .port = htons(self->srv0.port),
> > > > + };
> > > > + const struct landlock_net_service_attr bind_connect_host_endian_p1 = {
> > > > + .allowed_access = LANDLOCK_ACCESS_NET_BIND_TCP |
> > > > + LANDLOCK_ACCESS_NET_CONNECT_TCP,
> > > > + /* Host port format. */
> > > > + .port = self->srv1.port,
> > > > + };
> > > > + const unsigned int one = 1;
> > > > + const char little_endian = *(const char *)&one;
> > > > + int ruleset_fd;
> > > > +
> > > > + ruleset_fd =
> > > > + landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
> > > > + ASSERT_LE(0, ruleset_fd);
> > > > + ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_SERVICE,
> > > > + &bind_host_endian_p0, 0));
> > > > + ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_SERVICE,
> > > > + &connect_big_endian_p0, 0));
> > > > + ASSERT_EQ(0, landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_SERVICE,
> > > > + &bind_connect_host_endian_p1, 0));
> > > > + enforce_ruleset(_metadata, ruleset_fd);
> > > > +
> > > > + /* No restriction for big endinan CPU. */
> > > > + test_bind_and_connect(_metadata, &self->srv0, false, little_endian);
> > > > +
> > > > + /* No restriction for any CPU. */
> > > > + test_bind_and_connect(_metadata, &self->srv1, false, false);
> > > > +}
> > > > +
> > > > +TEST_HARNESS_MAIN
> > > .
> .
