test: the log is not this run's, so do not ask it for a total

The suite failed on the second run of a pair, on the two checks that
read /sys/log/fw:

	FAIL  a denied connection is logged, with the rule that said so
	      want: 1  got: 2

Not a firewall bug.  The checks counted matching lines in the whole
log, on the stated grounds that "the port is this run's, so the whole
file can be searched".  The port is 17000 + pid%900 and /sys/log/fw
keeps every run there has ever been, so the port is this run's only
until two runs pick the same one.  Thirty entries over nine hundred
ports is a two-in-five chance of a collision, and there it was:

	ports that appear more than once:
	   2 17538

So they are differences now, like the fragment count and the listen
log before them.  That is three checks in this suite that have had to
learn the same thing: a check that reads a file which outlives the run
must read it twice and subtract, because every other reading is a
measurement of the machine's history.

Verified passing; the stronger proof -- poisoning the log with a line
for every port the suite can pick, so the collision is certain rather
than likely -- did not finish, because the VM it was running on was
shut down partway through.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 13 insertions, 3 deletions

diff --git a/fw/test/fwtest.rc b/fw/test/fwtest.rc
index bd7423d..a7267ed 100755
--- a/fw/test/fwtest.rc
+++ b/fw/test/fwtest.rc
@@ -333,6 +333,8 @@ if(! test -f /sys/log/fw){
 	chmod 666 /sys/log/fw
 	madelog=yes
 }
+logdeny=`{grep -c 'deny tcp connect 127.0.0.2!'^$port^': denied by rule 1' /sys/log/fw}
+logallow=`{grep -c 'allow tcp connect 127.0.0.1!'^$port /sys/log/fw}
 @{
 	rfork n
 	{
@@ -345,10 +347,18 @@ if(! test -f /sys/log/fw){
 	wr /net/tcp/clone 'connect 127.0.0.1!'^$port >/dev/null
 }
 sleep 1
-# the port is this run's, so the whole file can be searched
-r=`{grep -c 'deny tcp connect 127.0.0.2!'^$port^': denied by rule 1' /sys/log/fw}
+# Differences, not totals.  This asked for a total on the grounds that
+# the port belonged to this run, and the port is 17000 + pid%900 while
+# the log keeps every run there has ever been: 30 entries over 900
+# ports collides about two times in five, and it duly did, on the
+# second run of a pair.  Nothing that reads an accumulating file may
+# ask it for a total - that is the third check in this suite to learn
+# it, after the fragment count and the listen log.
+after=`{grep -c 'deny tcp connect 127.0.0.2!'^$port^': denied by rule 1' /sys/log/fw}
+r=`{echo $logdeny $after | awk '{print $2 - $1}'}
 check 'a denied connection is logged, with the rule that said so' 1 $"r
-r=`{grep -c 'allow tcp connect 127.0.0.1!'^$port /sys/log/fw}
+after=`{grep -c 'allow tcp connect 127.0.0.1!'^$port /sys/log/fw}
+r=`{echo $logallow $after | awk '{print $2 - $1}'}
 check 'and a permitted one, when the rule asks' 1 $"r
 if(~ $madelog yes)
 	rm -f /sys/log/fw