laantungir/fips
1
0
Fork 0
mirror of https://github.com/jmcorgan/fips.git synced 2026-07-30 19:46:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(acl-allowlist): poll log assertion to absorb XX-handshake timing race

Browse Source 
Convert assert_log_contains from a one-shot grep snapshot into a
bounded poll that retries until the pattern appears or the timeout
elapses (default 15s). Same wait-with-timeout shape as
wait_for_peers_exact above it in the file.

The pre-existing flake on next-branch CI is structural: under XX
handshake, the cross-connection tie-breaker selects which side
reaches its ACL-check point first. When container-a wins the
tie-breaker on the first attempt against c and d, only the
outbound-handshake-context rejection fires immediately, and the
inbound-handshake-context rejection only emits on a later retry
when c or d's msg1 lands while a has no pending outbound. On one
2026-05-14 run the inbound rejection appeared 63ms after the test
had given up. The race window is small but real.

Polling the log instead of one-shot reading absorbs the
millisecond-to-second variance without slowing the success path
(the helper returns as soon as the pattern appears).
This commit is contained in:
Johnathan Corgan
2026-05-14 17:07:32 +00:00
parent 4f3d2f8471
commit e9dd3167f2
1 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/acl-allowlist/test.sh
+18 -6
View File
@@ -98,13 +98,25 @@ wait_for_peers_exact() {
assert_log_contains() {
local container="$1"
local pattern="$2"
local timeout="${3:-15}"
local logs
logs="$(docker logs "$container" 2>&1 | python3 -c 'import re,sys; print(re.sub(r"\x1b\[[0-9;]*m", "", sys.stdin.read()), end="")' || true)"
if ! printf '%s' "$logs" | grep -F "$pattern" >/dev/null; then
echo "FAIL: missing log pattern in $container: $pattern" >&2
exit 1
fi
echo "PASS: $container logs contain expected ACL rejection"
# Poll docker logs instead of one-shot reading: under XX handshake,
# the cross-connection tie-breaker determines which side reaches
# its ACL-check point first, so the inbound-handshake-context
# rejection may not emit until a later retry. Same wait-with-timeout
# shape as wait_for_peers_exact above.
for _ in $(seq 1 "$timeout"); do
logs="$(docker logs "$container" 2>&1 | python3 -c 'import re,sys; print(re.sub(r"\x1b\[[0-9;]*m", "", sys.stdin.read()), end="")' || true)"
if printf '%s' "$logs" | grep -F "$pattern" >/dev/null; then
echo "PASS: $container logs contain expected ACL rejection"
return 0
fi
sleep 1
done
echo "FAIL: missing log pattern in $container: $pattern (waited ${timeout}s)" >&2
exit 1
}
if [ "$SKIP_BUILD" = false ]; then