From 291c4312dc649b0d46a29869b55e83ff1eb74558 Mon Sep 17 00:00:00 2001
From: Johnathan Corgan <johnathan@corganlabs.com>
Date: Thu, 23 Jul 2026 02:42:36 +0000
Subject: [PATCH] Stop the ACL peer-count reader from turning "no answer" into
 zero
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

wait_for_peers_exact fell back to 0 when it could not read a container's peer
count. Two of its six call sites are the ACL denial checks, which expect
exactly 0 connected peers — so a failed docker exec satisfied them on the
first iteration and the isolation property the suite exists to prove was
never observed. Confirmed against a container that does not exist: the old
reader returns "0" and the expect-zero comparison passes.

The reader now returns the empty string when the daemon does not answer,
which no numeric comparison can satisfy, and the timeout message says which
of the two happened — never answered, or answered the wrong number. Same
shape as admission-cap-test.sh's read_peer_count.
---
 testing/acl-allowlist/test.sh | 33 +++++++++++++++++++++++++++------
 1 file changed, 27 insertions(+), 6 deletions(-)

diff --git a/testing/acl-allowlist/test.sh b/testing/acl-allowlist/test.sh
index 3457af2..f2dff98 100755
--- a/testing/acl-allowlist/test.sh
+++ b/testing/acl-allowlist/test.sh
@@ -75,22 +75,43 @@ assert_acl_field() {
     echo "PASS: $container ACL field $field matches expected value"
 }
 
+# Connected-peer count for a container, or the empty string if it did not
+# answer.
+#
+# Empty is deliberately distinct from a real 0, and here the distinction is
+# the whole point: the ACL denial checks below expect exactly 0, so an
+# `|| echo 0` fallback lets an unreachable container satisfy them on the first
+# iteration and the security property is never observed. Same shape as
+# admission-cap-test.sh's read_peer_count.
+read_connected_peers() {
+    local container="$1"
+    docker exec "$container" fipsctl show peers 2>/dev/null \
+        | python3 -c 'import json,sys; data=json.load(sys.stdin); print(sum(1 for p in data.get("peers", []) if p.get("connectivity") == "connected"))' 2>/dev/null \
+        || true
+}
+
 wait_for_peers_exact() {
     local container="$1"
     local expected_count="$2"
     local timeout="${3:-30}"
 
+    local count="" answered=false
     for _ in $(seq 1 "$timeout"); do
-        local count
-        count=$(docker exec "$container" fipsctl show peers 2>/dev/null \
-            | python3 -c 'import json,sys; data=json.load(sys.stdin); print(sum(1 for p in data.get("peers", []) if p.get("connectivity") == "connected"))' 2>/dev/null || echo 0)
-        if [ "$count" -eq "$expected_count" ]; then
-            return 0
+        count=$(read_connected_peers "$container")
+        if [ -n "$count" ]; then
+            answered=true
+            if [ "$count" -eq "$expected_count" ]; then
+                return 0
+            fi
         fi
         sleep 1
     done
 
-    echo "FAIL: $container did not reach $expected_count connected peers in ${timeout}s" >&2
+    if [ "$answered" = false ]; then
+        echo "FAIL: $container never answered a peer query in ${timeout}s, so a count of $expected_count was never actually observed" >&2
+    else
+        echo "FAIL: $container did not reach $expected_count connected peers in ${timeout}s (last answer: $count)" >&2
+    fi
     docker exec "$container" fipsctl show peers >&2 || true
     exit 1
 }