false positive. "apiclient report cis" reports failure on 3.4.1.2 and 3.4.2.2, when iptables rules are setup correctly.

[pengubco]

Package I'm using:
bloodhound

What I expected to happen:
apiclient report cis -l 2 reports PASS on 3.4.1.2 and 3.4.2.2. Because the iptables output is correct according to the CIS benchmark guide.

bash-5.2# ip6tables -L INPUT -v -n
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  lo     *       ::/0                 ::/0                
    0     0 DROP       all  --  *      *       ::1                  ::/0

bash-5.2# ip6tables -L OUTPUT -v -n
Chain OUTPUT (policy DROP 4 packets, 224 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      lo      ::/0                 ::/0    

What actually happened:
apiclient report cis -l 2 -f json reports FAIL on 3.4.1.2 and 3.4.2.2.

        "br03040102": {
            "name": "br03040102",
            "id": "3.4.1.2",
            "level": 2,
            "title": "Ensure IPv4 loopback traffic is configured",
            "mode": "Automatic",
            "status": "FAIL",
            "error": "iptables OUTPUT rule not found"
        },
        "br03040202": {
            "name": "br03040202",
            "id": "3.4.2.2",
            "level": 2,
            "title": "Ensure IPv6 loopback traffic is configured",
            "mode": "Automatic",
            "status": "FAIL",
            "error": "iptables OUTPUT rule not found"
        },

How to reproduce the problem:
Get aws-dev variant, add a new service to execute the following. Build the AMI, start an instance and run apiclient report cis -l 2.

ExecStartPre=/sbin/iptables -A INPUT -i lo -j ACCEPT
ExecStartPre=/sbin/iptables -A OUTPUT -o lo -j ACCEPT
ExecStartPre=/sbin/iptables -A INPUT -s 127.0.0.0/8 -j DROP

ExecStartPre=/sbin/ip6tables -A INPUT -i lo -j ACCEPT
ExecStartPre=/sbin/ip6tables -A OUTPUT -o lo -j ACCEPT
ExecStartPre=/sbin/ip6tables -A INPUT -s ::1 -j DROP