M2: refcnt_rele polarity, radix SALEN by family, LIST_HEAD dispatch + harness scp-failure hardening (gates 01-03 green)

tests/vm/04-anchors.sh

@@ -10,10 +10,21 @@ pass out quick
 C
 pfload /tmp/g4main.conf || { bad mainload; finish; }
 cat > /tmp/g4anc.conf <<'C'
-pass in quick proto icmp from 10.0.1.10 to any
+pass in quick proto icmp from 10.0.1.10 to any keep state
 C
-r=$(pfput /tmp/g4anc.conf); pf0 "/opt/pf/pfctl -a restricted -f $r" || { bad anchorload; finish; }
-cli "ping -c1 -W2 $SRV_IP >/dev/null 2>&1" && ok "anchor pass evaluated before block" || bad "anchor pass not honored"
+r=$(pfput /tmp/g4anc.conf) || { bad anchorload; finish; }
+pf0 "/opt/pf/pfctl -a restricted -f $r" || { bad anchorload; finish; }
+# The ICMP echo request is passed by the anchor's rule (evaluated before the
+# main ruleset's block line); the echo reply is carried by the state that the
+# request created.  The first reply after the ruleset load races with that
+# state on the freshly booted pf0, so retry a few times: if the anchor's rule
+# is not honoured the *request* is dropped and no retry can succeed.
+pass_ok=0
+for _ in 1 2 3 4 5; do
+	if cli "ping -c1 -W2 $SRV_IP >/dev/null 2>&1"; then pass_ok=1; break; fi
+	sleep 1
+done
+[ "$pass_ok" = 1 ] && ok "anchor pass evaluated before block" || bad "anchor pass not honored"
 # anchor rules are evaluated BEFORE the main-ruleset block line (top placement)
 pf0 '/opt/pf/pfctl -s Anchors' | grep -q restricted && ok "anchors listed" || bad "anchor list"
 pf0 '/opt/pf/pfctl -d; /opt/pf/pfctl -f /dev/null' >/dev/null; finish

tests/vm/lib.sh

@@ -8,14 +8,24 @@ pf0() { ssh -o ConnectTimeout=10 "$DEB" "$SSHBASE$PF0_IP \"$*\""; }
 cli() { ssh -o ConnectTimeout=10 "$DEB" "$SSHBASE$CLI_IP \"$*\""; }
 srv() { ssh -o ConnectTimeout=10 "$DEB" "$SSHBASE$SRV_IP \"$*\""; }
 gw2() { ssh -o ConnectTimeout=10 "$DEB" "$SSHBASE$GW2_IP \"$*\""; }
+# Upload a config to pf0.  The scp through the libvirt jump host is
+# occasionally refused ("stdio forwarding failed"); a silent failure used to
+# leave a *stale* config on pf0 (or none at all), which showed up as a
+# bogus gate failure.  Retry and fail loudly instead.
 pfput() {
-	local f="$1"
-	scp -q -o ProxyJump=root@192.168.1.242 -o StrictHostKeyChecking=accept-new \
-		-i "$HOME/.ssh/pflab_ed" "$f" pf0:/tmp/ 2>/dev/null || \
-	ssh "$DEB" "true" # alias must exist; fallback no-op
-	echo "/tmp/$(basename "$f")"
+	local f="$1" i
+	for i in 1 2 3; do
+		if scp -q -o ProxyJump=root@192.168.1.242 -o StrictHostKeyChecking=accept-new \
+			-i "$HOME/.ssh/pflab_ed" "$f" pf0:/tmp/ 2>/dev/null; then
+			echo "/tmp/$(basename "$f")"
+			return 0
+		fi
+		sleep 2
+	done
+	echo "pfput: upload of $f to pf0 failed" >&2
+	return 1
 }
-pfload() { local r; r=$(pfput "$1"); pf0 "/opt/pf/pfctl -f $r" && return 0; return 1; }
+pfload() { local r; r=$(pfput "$1") || return 1; pf0 "/opt/pf/pfctl -f $r" && return 0; return 1; }
 ok()   { echo "OK $*"; }
 bad()  { echo "NOT OK: $*" >&2; FAILED=1; }
 finish(){ [ "${FAILED:-0}" = 1 ] && exit 1; exit 0; }