From 5bf7e1f5ea541af3275e287939485fa2b4149e2c Mon Sep 17 00:00:00 2001 From: Calvin Morrison Date: Wed, 19 Aug 2026 10:57:54 -0400 Subject: test: the log is not this run's, so do not ask it for a total The suite failed on the second run of a pair, on the two checks that read /sys/log/fw: FAIL a denied connection is logged, with the rule that said so want: 1 got: 2 Not a firewall bug. The checks counted matching lines in the whole log, on the stated grounds that "the port is this run's, so the whole file can be searched". The port is 17000 + pid%900 and /sys/log/fw keeps every run there has ever been, so the port is this run's only until two runs pick the same one. Thirty entries over nine hundred ports is a two-in-five chance of a collision, and there it was: ports that appear more than once: 2 17538 So they are differences now, like the fragment count and the listen log before them. That is three checks in this suite that have had to learn the same thing: a check that reads a file which outlives the run must read it twice and subtract, because every other reading is a measurement of the machine's history. Verified passing; the stronger proof -- poisoning the log with a line for every port the suite can pick, so the collision is certain rather than likely -- did not finish, because the VM it was running on was shut down partway through. Co-Authored-By: Claude Opus 5 --- fw/test/fwtest.rc | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) (limited to 'fw') diff --git a/fw/test/fwtest.rc b/fw/test/fwtest.rc index bd7423d..a7267ed 100755 --- a/fw/test/fwtest.rc +++ b/fw/test/fwtest.rc @@ -333,6 +333,8 @@ if(! test -f /sys/log/fw){ chmod 666 /sys/log/fw madelog=yes } +logdeny=`{grep -c 'deny tcp connect 127.0.0.2!'^$port^': denied by rule 1' /sys/log/fw} +logallow=`{grep -c 'allow tcp connect 127.0.0.1!'^$port /sys/log/fw} @{ rfork n { @@ -345,10 +347,18 @@ if(! test -f /sys/log/fw){ wr /net/tcp/clone 'connect 127.0.0.1!'^$port >/dev/null } sleep 1 -# the port is this run's, so the whole file can be searched -r=`{grep -c 'deny tcp connect 127.0.0.2!'^$port^': denied by rule 1' /sys/log/fw} +# Differences, not totals. This asked for a total on the grounds that +# the port belonged to this run, and the port is 17000 + pid%900 while +# the log keeps every run there has ever been: 30 entries over 900 +# ports collides about two times in five, and it duly did, on the +# second run of a pair. Nothing that reads an accumulating file may +# ask it for a total - that is the third check in this suite to learn +# it, after the fragment count and the listen log. +after=`{grep -c 'deny tcp connect 127.0.0.2!'^$port^': denied by rule 1' /sys/log/fw} +r=`{echo $logdeny $after | awk '{print $2 - $1}'} check 'a denied connection is logged, with the rule that said so' 1 $"r -r=`{grep -c 'allow tcp connect 127.0.0.1!'^$port /sys/log/fw} +after=`{grep -c 'allow tcp connect 127.0.0.1!'^$port /sys/log/fw} +r=`{echo $logallow $after | awk '{print $2 - $1}'} check 'and a permitted one, when the rule asks' 1 $"r if(~ $madelog yes) rm -f /sys/log/fw -- cgit v1.2.3