#!/usr/bin/env bash
# tests/dc-node-v6-verify/run-tests.sh -- guard for scripts/dc-node-v6-verify.sh
# (gate G19: are the node IPv6 statics actually UP, and does a plane CARRY v6?).
#
# TWO HALVES.
# STATIC (T1-T10): the properties a silent edit would destroy -- above all the
# ABSENCE of any v6 prefix literal, which is what makes this gate survive
# D-139's ULA->GUA carve without an edit.
# BEHAVIORAL (T11-T54): plan / node / bridges are DRIVEN against fake
# maas/ip/ping/virsh on PATH and a mktemp SYSROOT. Every FAIL and every
# REFUSE branch has its own failing fixture, because a grep cannot tell a
# gate that fails from one that merely cannot fail.
#
# WHAT THE GREEN BELOW DOES NOT PROVE: no node has ever been asserted by it. This
# is a FIXTURE green; the real gate is `plan` on the region host and `node` on a
# deployed node.
#
# Exit: 0 all pass | 1 any case failed. ASCII + LF.
set -uo pipefail
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SCRIPT="$(cd "$HERE/../.." && pwd)/scripts/dc-node-v6-verify.sh"
PASS=0; FAIL=0
ok(){ echo " PASS $1"; PASS=$((PASS+1)); }
no(){ echo " FAIL $1"; FAIL=$((FAIL+1)); }
fin(){ echo; echo "dc-node-v6-verify: $PASS passed, $FAIL failed"; [ "$FAIL" -eq 0 ] || exit 1; exit 0; }
[ -f "$SCRIPT" ] && ok "T1 script present" || { no "T1 script present"; fin; }
bash -n "$SCRIPT" 2>/dev/null && ok "T2 bash -n clean" || no "T2 bash -n clean"
# ===========================================================================
# STATIC
# ===========================================================================
# T3: THE constraint. D-139 retires the VR1 ULA /48 and moves every plane to
# GUA, so any prefix literal in executed code is correct today and wrong on
# carve day. Comments may DISCUSS prefixes; code may not contain one.
CODE="$(grep -vE '^[[:space:]]*#' "$SCRIPT")"
if grep -qiE '(fd[0-9a-f]{2}:[0-9a-f]{1,4}:)|(2602:[0-9a-f]{1,4}:)|fc00::' <<<"$CODE"; then
no "T3 no v6 prefix literal in executed code (D-139 rot guard)"
grep -niE '(fd[0-9a-f]{2}:[0-9a-f]{1,4}:)|(2602:[0-9a-f]{1,4}:)|fc00::' <<<"$CODE" | sed 's/^/ /'
else ok "T3 no v6 prefix literal in executed code (D-139 rot guard)"; fi
# T4: no v4 plane literal either -- the expectation comes from MAAS, not a table.
grep -qE '10\.12\.[0-9]+\.' <<<"$CODE" \
&& no "T4 no v4 plane literal in executed code" || ok "T4 no v4 plane literal in executed code"
# T5: the three-outcome contract is declared, not just implemented.
grep -q 'EXIT: 0 PASS | 1 FAIL | 2 bad args | 3 REFUSE' "$SCRIPT" \
&& ok "T5 exit contract 0/1/2/3 documented in the header" \
|| no "T5 exit contract 0/1/2/3 documented in the header"
# T6: BREVITY CHARTER -- the header is the file's own budget, so it is asserted.
HDRLEN="$(awk 'NR>1 && /^#/{n++; next} NR>1{exit} END{print n+0}' "$SCRIPT")"
[ "$HDRLEN" -le 25 ] && ok "T6 header is $HDRLEN comment lines (<=25)" \
|| no "T6 header is $HDRLEN comment lines (>25)"
# T7/T8: site + mode validation. A bare dcN is D-119-retired everywhere else in
# this repo and must not sneak in here through a permissive case arm.
for s in dc0 vr1-dc2 ""; do
bash "$SCRIPT" node "$s" x >/dev/null 2>&1; [ $? -eq 2 ] || { BAD=1; break; }
done
[ "${BAD:-0}" -eq 0 ] && ok "T7 unknown/bare site rejected with rc=2" || no "T7 unknown/bare site rejected with rc=2"
bash "$SCRIPT" verify vr1-dc0 >/dev/null 2>&1; [ $? -eq 2 ] \
&& ok "T8 unknown mode rejected with rc=2" || no "T8 unknown mode rejected with rc=2"
# T9: node must stay root-free and rack-free -- it runs on a machine that has
# neither the repo nor privileges. sudo/systemctl/virsh in the node arm would
# make a red mean "wrong host", not "wrong address".
NODEBODY="$(awk '/^do_node\(\)/{f=1} f{print} f&&/^}/{exit}' "$SCRIPT")"
grep -qE '\b(sudo|systemctl|virsh|maas)\b' <<<"$NODEBODY" \
&& no "T9 node arm touches only unprivileged read-only tools" \
|| ok "T9 node arm touches only unprivileged read-only tools"
# T10: ping BEFORE the neighbour read. Reading the cache first would report a
# stale or empty entry and invent a contradiction that does not exist.
PING_LN="$(grep -n 'ping -6 -c' <<<"$NODEBODY" | head -1 | cut -d: -f1)"
NEI_LN="$(grep -n 'neigh show to' <<<"$NODEBODY" | head -1 | cut -d: -f1)"
[ -n "$PING_LN" ] && [ -n "$NEI_LN" ] && [ "$PING_LN" -lt "$NEI_LN" ] \
&& ok "T10 ping runs before the neighbour cache is read" \
|| no "T10 ping runs before the neighbour cache is read"
# ===========================================================================
# BEHAVIORAL
# ===========================================================================
TMP="$(mktemp -d)"; FB="$TMP/bin"; SR="$TMP/sysroot"; mkdir -p "$FB" "$SR"
trap 'rm -rf "$TMP"' EXIT
# MINBIN: a PATH carrying the script's coreutils and NOTHING ELSE, so the
# "tool is absent" cases are driven for real. /usr/bin:/bin was NOT enough --
# MEASURED on this jumphost, `ip` and `virsh` are both on it, so those two
# REFUSE cases silently ran the HOST's binaries and reported a false red.
MINBIN="$TMP/minbin"; FBIP="$TMP/ipbin"; mkdir -p "$MINBIN" "$FBIP"
for t in bash env awk grep sed cat tr uname python3 mktemp; do
p="$(command -v "$t" 2>/dev/null)" && ln -sf "$p" "$MINBIN/$t"
done
cat > "$FB/maas" <<'FAKE'
#!/usr/bin/env bash
case "$(cat "$FAKEDIR/maas.mode")" in
err) echo "profile not logged in" >&2; exit 1 ;;
junk) printf 'this is not json\n' ;;
*) cat "$FAKEDIR/machines.json" ;;
esac
FAKE
cat > "$FB/ip" <<'FAKE'
#!/usr/bin/env bash
args="$*"; W="$(cat "$FAKEDIR/addr.want")"
case "$args" in
*"link show"*)
case "$(cat "$FAKEDIR/ip.link")" in
up) printf '3: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP\\ link/ether 52:54:00:aa:bb:01\n' ;;
nocarrier) printf '3: enp1s0: <BROADCAST,MULTICAST,UP> mtu 1500 state DOWN\\ link/ether 52:54:00:aa:bb:01\n' ;;
absent) echo 'Device "enp1s0" does not exist.' >&2; exit 1 ;;
esac ;;
*"addr show"*)
case "$(cat "$FAKEDIR/ip.addr")" in
ok) printf '3: enp1s0 inet6 %s scope global \\ valid_lft forever preferred_lft forever\n' "$W" ;;
missing) : ;;
tentative) printf '3: enp1s0 inet6 %s scope global tentative \\ valid_lft forever\n' "$W" ;;
dadfailed) printf '3: enp1s0 inet6 %s scope global dadfailed \\ valid_lft forever\n' "$W" ;;
extra) printf '3: enp1s0 inet6 %s scope global \\ valid_lft forever\n' "$W"
printf '3: enp1s0 inet6 %s scope global \\ valid_lft forever\n' "$(cat "$FAKEDIR/addr.extra")" ;;
esac ;;
*"neigh show"*)
s="$(cat "$FAKEDIR/ip.neigh")"
[ "$s" = absent ] || printf '%s dev enp1s0 lladdr 52:54:00:aa:bb:02 %s\n' "$(cat "$FAKEDIR/peer")" "$s" ;;
esac
FAKE
cat > "$FB/ping" <<'FAKE'
#!/usr/bin/env bash
exit "$(cat "$FAKEDIR/ping.rc")"
FAKE
cat > "$FB/virsh" <<'FAKE'
#!/usr/bin/env bash
case "$*" in
*"net-list"*) cat "$FAKEDIR/virsh.nets" ;;
*"net-dumpxml"*)
n="${@: -1}"
[ "$(cat "$FAKEDIR/virsh.xml")" = "ok" ] || exit 1
printf "<network>\n <name>%s</name>\n <bridge name='br-%s' stp='on'/>\n</network>\n" "$n" "${n##*-}" ;;
esac
FAKE
chmod +x "$FB"/*
cp "$FB/ip" "$FBIP/ip"
# Machine fixtures are GENERATED from a prefix base, so the same green case can be
# driven with the ULA carve MAAS holds today and the GUA carve D-139 rules --
# which is the evidence that no prefix is baked in anywhere.
mk_machines() { # mk_machines <base> <shape>
python3 - "$1" "$2" <<'PY' > "$TMP/machines.json"
import json, sys
base, shape = sys.argv[1], sys.argv[2]
planes = [("enp1s0", base + ":20::/64"), ("enp3s0", base + ":21::/64")]
hosts = ["fun-crab", "wise-newt", "keen-mole"]
if shape == "lonely": hosts = hosts[:1]
out = []
for n, h in enumerate(hosts):
ifs = []
for idx, (nic, cidr) in enumerate(planes):
if shape == "diverge" and h == "keen-mole" and nic == "enp3s0": continue
if shape == "empty" and h == "keen-mole": continue
links = [{"ip_address": cidr.split("::/")[0] + "::%d" % (100 + n),
"subnet": {"cidr": cidr}}]
if shape == "dup" and h == "fun-crab" and nic == "enp1s0":
links.append({"ip_address": cidr.split("::/")[0] + "::200",
"subnet": {"cidr": cidr}})
ifs.append({"name": nic, "links": links})
ifs.append({"name": "enp2s0", "links": [{"ip_address": "10.12.4.%d" % (100 + n),
"subnet": {"cidr": "10.12.4.0/22"}}]})
out.append({"hostname": h, "system_id": "sys%d" % n,
"tag_names": ([] if shape == "notag" else ["openstack-vr1-dc0"]),
"interface_set": ifs})
json.dump(out, sys.stdout)
PY
}
run_plan() { # run_plan <want_rc> <regex> <label>
local want="$1" rx="$2" label="$3" out rc
out="$(env FAKEDIR="$TMP" PATH="$FB:$PATH" MAAS_PROFILE=fake \
bash "$SCRIPT" plan vr1-dc0 2>&1)"; rc=$?
if [ "$rc" = "$want" ] && grep -qE "$rx" <<<"$out"; then ok "$label"
else no "$label (rc=$rc want=$want)"; sed 's/^/ /' <<<"$out" | head -10; fi
}
run_node() { # run_node <spec> <want_rc> <regex> <label>
local spec="$1" want="$2" rx="$3" label="$4" out rc
out="$(env FAKEDIR="$TMP" PATH="$FB:$PATH" bash "$SCRIPT" node vr1-dc0 "$spec" 2>&1)"; rc=$?
if [ "$rc" = "$want" ] && grep -qE "$rx" <<<"$out"; then ok "$label"
else no "$label (rc=$rc want=$want)"; sed 's/^/ /' <<<"$out" | head -10; fi
}
run_br() { # run_br <want_rc> <regex> <label>
local want="$1" rx="$2" label="$3" out rc
out="$(env FAKEDIR="$TMP" DC_NODE_V6_SYSROOT="$SR" PATH="$FB:$PATH" \
bash "$SCRIPT" bridges vr1-dc0 2>&1)"; rc=$?
if [ "$rc" = "$want" ] && grep -qE "$rx" <<<"$out"; then ok "$label"
else no "$label (rc=$rc want=$want)"; sed 's/^/ /' <<<"$out" | head -10; fi
}
# --- plan ------------------------------------------------------------------
printf 'ok' > "$TMP/maas.mode"
# T11 is the baseline: if the green case cannot pass, nothing below means anything.
mk_machines "fd50:840e:74e2" green
run_plan 0 'plan \(vr1-dc0\): PASS' "T11 plan: uniform carve -> PASS (ULA fixture, the carve MAAS holds today)"
run_plan 0 'fd50:840e:74e2:20::/64' "T12 plan: prints the DERIVED prefixes, so the reader sees which carve is asserted"
run_plan 0 'fun-crab enp1s0=fd50:840e:74e2:20::/64=fd50:840e:74e2:20::100=fd50:840e:74e2:20::101=wise-newt' \
"T13 plan: SPEC line carries iface/cidr/self/peer/peerhost, peer is another machine"
# T14: the whole prefix-source argument, executed. Same script, GUA fixture,
# same green -- so D-139's carve needs no edit here.
mk_machines "2602:f3e2:f02" green
run_plan 0 '2602:f3e2:f02:21::/64=2602:f3e2:f02:21::100' "T14 plan: GUA fixture is equally green (D-139-proof)"
mk_machines "fd50:840e:74e2" green
mk_machines "fd50:840e:74e2" diverge
run_plan 1 'keen-mole v6 plane set DIFFERS' "T15 plan: an under-carved machine -> FAIL"
mk_machines "fd50:840e:74e2" empty
run_plan 1 'keen-mole carries NO v6 link' "T16 plan: a machine with zero v6 links -> FAIL"
mk_machines "fd50:840e:74e2" dup
run_plan 1 'holds 2 v6 links on plane' "T17 plan: two v6 links on one plane -> FAIL (expectation is ambiguous)"
mk_machines "fd50:840e:74e2" lonely
run_plan 3 'has only 1 machine' "T18 plan: a peerless plane -> REFUSE, not a pass"
mk_machines "fd50:840e:74e2" notag
run_plan 3 'no machine carries the tag openstack-vr1-dc0' "T19 plan: empty tag selection -> REFUSE (wrong region looks like this)"
mk_machines "fd50:840e:74e2" green
printf 'err' > "$TMP/maas.mode"
run_plan 3 "maas fake machines read' failed" "T20 plan: MAAS error -> REFUSE"
printf 'junk' > "$TMP/maas.mode"
run_plan 3 'unparseable JSON' "T21 plan: unparseable MAAS answer -> REFUSE"
printf 'ok' > "$TMP/maas.mode"
OUT="$(env FAKEDIR="$TMP" PATH="$MINBIN" MAAS_PROFILE=fake bash "$SCRIPT" plan vr1-dc0 2>&1)"; RC=$?
[ "$RC" -eq 3 ] && grep -q "MISSING TOOL is not an empty MAAS" <<<"$OUT" \
&& ok "T22 plan: absent maas CLI -> REFUSE ('could not look' is not 'nothing there')" \
|| no "T22 plan: absent maas CLI -> REFUSE ('could not look' is not 'nothing there')"
OUT="$(env FAKEDIR="$TMP" PATH="$FB:$PATH" bash "$SCRIPT" plan vr1-dc0 --profile vr1-dc0-region 2>&1)"
grep -q "maas profile 'vr1-dc0-region' (from --profile)" <<<"$OUT" \
&& ok "T23 plan: names the profile and where it came from (wrong-region is silent otherwise)" \
|| no "T23 plan: names the profile and where it came from (wrong-region is silent otherwise)"
OUT="$(env FAKEDIR="$TMP" PATH="$FB:$PATH" MAAS_PROFILE=envprof bash "$SCRIPT" plan vr1-dc0 2>&1)"
grep -q "maas profile 'envprof' (from MAAS_PROFILE env)" <<<"$OUT" \
&& ok "T24 plan: honours MAAS_PROFILE and says so" || no "T24 plan: honours MAAS_PROFILE and says so"
env FAKEDIR="$TMP" PATH="$FB:$PATH" bash "$SCRIPT" plan vr1-dc0 --bogus >/dev/null 2>&1; [ $? -eq 2 ] \
&& ok "T25 plan: unknown option rejected rc=2" || no "T25 plan: unknown option rejected rc=2"
# --- node ------------------------------------------------------------------
B="fd50:840e:74e2:20"
SPEC="enp1s0=$B::/64=$B::100=$B::101=wise-newt"
printf '%s' "$B::100/64" > "$TMP/addr.want"
printf '%s' "$B::101" > "$TMP/peer"
printf '%s' "$B::999/64" > "$TMP/addr.extra"
green_node(){ printf 'up' > "$TMP/ip.link"; printf 'ok' > "$TMP/ip.addr"
printf 'REACHABLE' > "$TMP/ip.neigh"; printf '0' > "$TMP/ping.rc"; }
green_node
run_node "$SPEC" 0 'node \(vr1-dc0\): PASS' "T26 node: address up + peer replies + neighbour REACHABLE -> PASS"
run_node "$SPEC" 0 'sole global on the NIC' "T27 node: reports the address as the SOLE global on the NIC"
printf 'missing' > "$TMP/ip.addr"
run_node "$SPEC" 1 'MAAS holds .* but the NIC does not carry it' \
"T28 node: MAAS holds the link, the NIC does not -> FAIL (the recorded lesson, executed)"
printf 'tentative' > "$TMP/ip.addr"
run_node "$SPEC" 1 'still TENTATIVE' "T29 node: DAD incomplete -> FAIL"
printf 'dadfailed' > "$TMP/ip.addr"
run_node "$SPEC" 1 'DADFAILED' "T30 node: duplicate address -> FAIL"
printf 'extra' > "$TMP/ip.addr"
run_node "$SPEC" 1 'unexpected global' "T31 node: an EXTRA global on the plane -> FAIL (the stale-prefix signature)"
green_node
printf 'absent' > "$TMP/ip.link"
run_node "$SPEC" 1 'interface ABSENT on this node' "T32 node: interface absent -> FAIL"
printf 'nocarrier' > "$TMP/ip.link"
run_node "$SPEC" 1 'no LOWER_UP' "T33 node: no carrier -> FAIL (an address on a dead link carries nothing)"
green_node
# T34-T37: the four (ping x neighbour) quadrants. This is the whole point of
# assertion (2) -- each quadrant must name a DIFFERENT next step.
printf '1' > "$TMP/ping.rc"; printf 'INCOMPLETE' > "$TMP/ip.neigh"
run_node "$SPEC" 1 'Neighbour Discovery did not resolve' \
"T34 node: no reply + INCOMPLETE -> FAIL naming ND, and points at the bridges diagnostic"
printf 'FAILED' > "$TMP/ip.neigh"
run_node "$SPEC" 1 'bridges vr1-dc0' "T35 node: no reply + FAILED -> FAIL with the same triage step"
printf 'REACHABLE' > "$TMP/ip.neigh"
run_node "$SPEC" 1 'NOT the multicast-ND class' \
"T36 node: no reply but neighbour RESOLVED -> FAIL, and explicitly NOT diagnosed as ND"
printf '0' > "$TMP/ping.rc"; printf 'INCOMPLETE' > "$TMP/ip.neigh"
run_node "$SPEC" 1 'CONTRADICTION' \
"T37 node: replies YET neighbour INCOMPLETE -> FAIL (a success one reading denies)"
printf 'absent' > "$TMP/ip.neigh"
run_node "$SPEC" 1 'CONTRADICTION' "T38 node: replies with NO neighbour entry at all -> FAIL"
green_node
printf 'WOBBLY' > "$TMP/ip.neigh"
run_node "$SPEC" 3 'is not one this gate recognises' "T39 node: unrecognised neighbour state -> REFUSE"
green_node
printf '2' > "$TMP/ping.rc"
run_node "$SPEC" 3 'the probe could not run' "T40 node: ping could not run -> REFUSE, never a pass"
green_node
run_node "enp1s0=$B::/64=$B::100=-=-" 3 'the data path cannot be evaluated' \
"T41 node: peerless plane -> REFUSE"
run_node "enp1s0=$B::/64" 2 'malformed SPEC entry' "T42 node: malformed SPEC -> rc=2"
env FAKEDIR="$TMP" PATH="$FB:$PATH" bash "$SCRIPT" node vr1-dc0 >/dev/null 2>&1; [ $? -eq 2 ] \
&& ok "T43 node: missing SPEC -> rc=2" || no "T43 node: missing SPEC -> rc=2"
OUT="$(env FAKEDIR="$TMP" PATH="$MINBIN" bash "$SCRIPT" node vr1-dc0 "$SPEC" 2>&1)"; RC=$?
[ "$RC" -eq 3 ] && grep -q "no 'ip' on this node" <<<"$OUT" \
&& ok "T44 node: absent ip(8) -> REFUSE" || no "T44 node: absent ip(8) -> REFUSE"
# T44b: ip present, ping absent. The address half must still be ASSERTED and only
# the reachability half REFUSE -- a missing prober must not blank the whole gate.
OUT="$(env FAKEDIR="$TMP" PATH="$FBIP:$MINBIN" bash "$SCRIPT" node vr1-dc0 "$SPEC" 2>&1)"; RC=$?
[ "$RC" -eq 3 ] && grep -q "reachability to .* is UNKNOWN, not absent" <<<"$OUT" \
&& grep -q "OK enp1s0" <<<"$OUT" \
&& ok "T44b node: absent ping -> address still asserted, reachability REFUSEs" \
|| no "T44b node: absent ping -> address still asserted, reachability REFUSEs"
# T45: a multi-plane SPEC must evaluate EVERY entry, not stop at the first.
printf 'missing' > "$TMP/ip.addr"
run_node "$SPEC,enp3s0=$B::/64=$B::100=$B::101=wise-newt" 1 \
'(FAIL.*does not carry it[[:space:]]*$|does not carry it)' "T45 node: every SPEC entry is evaluated"
OUT="$(env FAKEDIR="$TMP" PATH="$FB:$PATH" bash "$SCRIPT" node vr1-dc0 \
"$SPEC,enp3s0=$B::/64=$B::100=$B::101=wise-newt" 2>&1)"
[ "$(grep -c 'does not carry it' <<<"$OUT")" -eq 2 ] \
&& ok "T46 node: both entries reported, not just the first" || no "T46 node: both entries reported, not just the first"
green_node
# --- bridges ---------------------------------------------------------------
printf 'ok' > "$TMP/virsh.xml"
printf 'vr1-dc0-metal-admin\nvr1-dc0-storage\nvr0-dc0-other\n' > "$TMP/virsh.nets"
for b in admin storage; do mkdir -p "$SR/sys/class/net/br-$b/bridge"; done
printf '1\n' > "$SR/sys/class/net/br-admin/bridge/multicast_snooping"
printf '0\n' > "$SR/sys/class/net/br-admin/bridge/multicast_querier"
printf '1\n' > "$SR/sys/class/net/br-storage/bridge/multicast_snooping"
printf '1\n' > "$SR/sys/class/net/br-storage/bridge/multicast_querier"
run_br 0 'reported 2 bridge' "T47 bridges: reads the plane bridges, ignores other sites -> exit 0"
run_br 0 'br-admin +multicast_snooping=1 multicast_querier=0 +<-- SUSPECT' \
"T48 bridges: flags snooping=1/querier=0 as SUSPECT"
run_br 0 'br-storage +multicast_snooping=1 multicast_querier=1$' \
"T49 bridges: does NOT flag a bridge that has a querier"
run_br 0 'no Linux behaviour is asserted here' "T50 bridges: states plainly that it diagnoses nothing"
rm -f "$SR/sys/class/net/br-storage/bridge/multicast_querier"
run_br 3 'multicast state unreadable' "T51 bridges: unreadable sysfs -> REFUSE, never a silent 'fine'"
printf '1\n' > "$SR/sys/class/net/br-storage/bridge/multicast_querier"
printf 'vr0-dc0-other\n' > "$TMP/virsh.nets"
run_br 3 'no libvirt network named vr1-dc0-' "T52 bridges: no plane network -> REFUSE (UNKNOWN, not absent)"
printf 'vr1-dc0-metal-admin\n' > "$TMP/virsh.nets"
printf 'bad' > "$TMP/virsh.xml"
run_br 3 'did not resolve to a bridge' "T53 bridges: net with no bridge -> REFUSE"
printf 'ok' > "$TMP/virsh.xml"
OUT="$(env FAKEDIR="$TMP" DC_NODE_V6_SYSROOT="$SR" PATH="$MINBIN" bash "$SCRIPT" bridges vr1-dc0 2>&1)"; RC=$?
[ "$RC" -eq 3 ] && grep -q "no 'virsh' on this host" <<<"$OUT" \
&& ok "T54 bridges: absent virsh -> REFUSE" || no "T54 bridges: absent virsh -> REFUSE"
fin
