🍉 Sync 2026-09-25 18:00:12

luci-app-fwlive/root/usr/libexec/rpcd/fwlive

@@ -221,7 +221,7 @@ nft_dump_fields() {
 			next
 		print prefix "\t" comment
 	}
-	'
+	' || return 1
 }
 
 # pass=labeled|unlabeled|all — labeled before unlabeled so !fw4: beats
@@ -313,10 +313,14 @@ enrich_rules_dump() {
 			if [ -z "$_nft_tsv" ]; then
 				_enrich_error='mktemp_failed'
 			else
-				nft_dump_fields <"$_rules_dump" >"$_nft_tsv"
-				map_from_nft_stream labeled <"$_nft_tsv"
-				if [ -z "$_map_overflow" ]; then
-					map_from_nft_stream unlabeled <"$_nft_tsv"
+				# awk under set -eu must not abort the plugin before JSON.
+				if nft_dump_fields <"$_rules_dump" >"$_nft_tsv"; then
+					map_from_nft_stream labeled <"$_nft_tsv"
+					if [ -z "$_map_overflow" ]; then
+						map_from_nft_stream unlabeled <"$_nft_tsv"
+					fi
+				else
+					_enrich_error='tsv_failed'
 				fi
 				rm -f "$_nft_tsv"
 			fi
@@ -486,6 +490,12 @@ fetch_firewall_logs() {
 	case "$out" in
 		*'"error":'*) _filter_ok=0 ;;
 	esac
+	# Zero-exit JSON without a numeric messages_received is not a healthy
+	# sample. The merge fallback of 0 must not clear hot/shed.
+	case "$out" in
+		*'"messages_received":'[0-9]*) ;;
+		*) _filter_ok=0 ;;
+	esac
 	end_cs=$(fwlive_adaptive_clock_cs)
 	# Uptime wrap / skew: end < start — do not record as cold.
 	if [ "$_filter_ok" = 1 ] && [ "$end_cs" -ge "$start_cs" ]; then