From e471807239d5f127c2c2092f456d950622d7b2d9 Mon Sep 17 00:00:00 2001 From: Johnathan Corgan Date: Sat, 9 May 2026 18:27:38 +0000 Subject: [PATCH] testing/firewall: avoid SIGPIPE in drop-counter probe MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The drop-counter sanity check piped `nft list table inet fips` through `awk '/counter packets/ {print $3; exit}'`. Awk's `exit` on first match closes the pipe, the upstream `nft list` SIGPIPEs on its next write, `set -o pipefail` makes the pipeline return 141, and the surrounding command-substitution aborts the script before it can assign DROP_PKTS or print the section header. Replaces the early-exit pattern with `/counter packets/ && !seen { print $3; seen=1 }` — same first-match output, but awk reads the full input so nft never SIGPIPEs. The original form had been latent for as long as the test has existed; recent CI runs at master tip 53ad528 finally tripped it (output shows the script dying immediately after the case-(d) PASS, before "=== Drop counter incremented..." prints). Verified locally: `bash testing/ci-local.sh --only firewall` runs all six setup-and-functional steps green and prints "PASS: drop counter = 5". --- testing/firewall/test.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/testing/firewall/test.sh b/testing/firewall/test.sh index 75c758f..e21432f 100755 --- a/testing/firewall/test.sh +++ b/testing/firewall/test.sh @@ -238,7 +238,7 @@ fi # ── Drop-counter sanity ──────────────────────────────────────────────── log "Drop counter incremented (case a should have ticked it)" DROP_PKTS="$(docker exec "$CONTAINER_B" nft list table inet fips \ - | awk '/counter packets/ {print $3; exit}')" + | awk '/counter packets/ && !seen { print $3; seen=1 }')" if [ -z "${DROP_PKTS:-}" ] || [ "$DROP_PKTS" -lt 1 ]; then fail "drop counter is $DROP_PKTS — case (a) should have produced drops" fi