From e6ccc23bbb1d54662f89c45090a657bda2c3e29d Mon Sep 17 00:00:00 2001 From: Roberto Cano Date: Thu, 6 Aug 2026 13:35:26 +0200 Subject: [PATCH] fix(posture-check): parse nft -j set elements without a "val" wrapper The fence-coverage check grepped nft's JSON for '"val":[0-9]+', but nft prints plain set elements as "elem":[1001] -- the {"val":...} wrapper only appears when elements carry attributes (timeout, comment, counter). On a plain uid set live_uids therefore came back empty and every run paged "egress fence NOT LOADED" while the fence was demonstrably loaded: a false alarm, hourly, on the channel whose credibility the design depends on. Caught on the first manual run after installing the registry-driven artifacts on a live box. Pull the numbers from everything after "elem": instead, which matches both serializations. Co-Authored-By: Claude Fable 5 --- examples/dedicated-server/bin/posture-check.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/examples/dedicated-server/bin/posture-check.sh b/examples/dedicated-server/bin/posture-check.sh index f3b1938..3720efd 100755 --- a/examples/dedicated-server/bin/posture-check.sh +++ b/examples/dedicated-server/bin/posture-check.sh @@ -44,8 +44,10 @@ while IFS=: read -r user repo; do done < "$CONF" # ---- 2. egress-fence coverage --------------------------------------------- +# nft -j prints plain set elements as "elem":[1001] but wraps them as +# {"val":1001} when they carry attributes -- pull the numbers from either shape. live_uids=$(nft -j list set inet recode_agent agent_uids 2>/dev/null \ - | grep -oE '"val":[0-9]+' | cut -d: -f2 | sort -u) + | grep -o '"elem":.*' | grep -oE '[0-9]+' | sort -u) if [ -z "$live_uids" ]; then alert "BusyBee: egress fence NOT LOADED" \ "nftables table inet recode_agent has no agent_uids set -- NO agent is fenced"