M1: vendored sha2/md5 (OpenBSD 8.0) + endian/swap compat; module builds green

scripts/lab-lib.sh

@@ -38,7 +38,9 @@ deb()     { ssh "${SSH_OPTS[@]}" "$DEB_USER@$DEB" "$@"; }
 deb_cmd() { deb "bash -s" <<<"$1"; }
 
 # Run a shell script inside a lab VM (nested ssh from deb with the lab key).
-vm_cmd()  { local ip=$1; deb "ssh -i $LAB_KEY_DEB ${SSH_OPTS[*]} root@$ip 'bash -s'" <<<"$2"; }
+# Guest host keys change every lab rebuild -> pin-noise disabled for this hop.
+VMSSH_OPTS="-o BatchMode=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=5 -o LogLevel=ERROR"
+vm_cmd()  { local ip=$1; deb "ssh -i $LAB_KEY_DEB $VMSSH_OPTS root@$ip 'bash -s'" <<<"$2"; }
 
 # --- template rendering: replace @KEY@ tokens from environment + extra K=V ---
 RENDER_KEYS=(
@@ -148,7 +150,7 @@ ensure_guest_kernel() {
 default_kernelblock() { # prints kernelblock xml for extracted direct boot
   local uuid
   uuid=$(deb "cat $BOOT_DIR/guest-root.uuid")
-  printf '    <kernel>%s/guest-vmlinuz</kernel>\n    <initrd>%s/guest-initramfs</initrd>\n    <cmdline>root=UUID=%s ro console=ttyS0,115200n8</cmdline>' \
+  printf '    <kernel>%s/guest-vmlinuz</kernel>\n    <initrd>%s/guest-initramfs</initrd>\n    <cmdline>root=UUID=%s ro console=ttyS0,115200n8 modules=sd-mod,usb-storage,ext4,ena,gve</cmdline>' \
     "$BOOT_DIR" "$BOOT_DIR" "$uuid"
 }
 
@@ -219,17 +221,19 @@ packages_fixup() { # safety net if cloud-init ran before pf0 had transit up
   local a ip
   for a in $VMS; do
     ip=$(vm_ip "$a")
-    vm_cmd "$ip" 'command -v iperf3 >/dev/null 2>&1 || {
+    vm_cmd "$ip" 'command -v iperf3 >/dev/null 2>&1 && command -v iptables >/dev/null 2>&1 || {
       . /etc/os-release
       grep -qE "^[^#]*/community" /etc/apk/repositories || echo "${HOME}/v${VERSION_ID}/community" >> /etc/apk/repositories
       apk update -q >/dev/null 2>&1
-      apk add -q iperf3 tcpdump python3 py3-scapy bash >/dev/null 2>&1 || warn "apk add failed on '"$a"'"
+      apk add -q iperf3 tcpdump python3 scapy bash iptables >/dev/null 2>&1 || warn "apk add failed on '"$a"'"
     }' || warn "no ssh to $a for package fixup"
   done
 }
 
 # --- ssh access plumbing: aliases pf0|cli|srv|gw2 from deb and from laptop ---
 laptop_ssh_config() {
+  # fresh pin file per lab rebuild: guest host keys change with recreated disks
+  rm -f "$HOME/.ssh/known_hosts_pflab"
   mkdir -p "$(dirname "$LAPTOP_SSH_FRAG")"; chmod 700 "$(dirname "$LAPTOP_SSH_FRAG")" 2>/dev/null || true
   cat > "$LAPTOP_SSH_FRAG" <<EOF
 # >>> generated by pf_port/scripts/vm-create.sh (topology: lab/ips.env) >>>
@@ -267,7 +271,8 @@ deb_ssh_config() {
 Host pf0 cli srv gw2
   User root
   IdentityFile '"$LAB_KEY_DEB"'
-  StrictHostKeyChecking accept-new
+  StrictHostKeyChecking no
+  UserKnownHostsFile /dev/null
   LogLevel ERROR
   ConnectTimeout 8
 Host pf0

scripts/stage-port.sh

@@ -74,9 +74,10 @@ port_c() {
 
 PORTED_LIST='net/pf.c net/pf_ioctl.c net/pf_norm.c net/pf_if.c net/pf_lb.c
 net/pf_ruleset.c net/pf_table.c net/pf_osfp.c net/pf_syncookies.c
-net/ifq.c net/hfsc.c net/fq_codel.c net/if_pflog.c netinet/ip_divert.c'
+net/ifq.c net/hfsc.c net/fq_codel.c net/if_pflog.c netinet/ip_divert.c
+crypto/md5.c crypto/sha2.c'
 # NOTE: radix.c/rtable.c (ported by hand in T10 against our cleaned
-# compat/net/radix.h) and siphash/toeplitz/sha2 (own PFLINUX impls) are
+# compat/net/radix.h) and siphash/toeplitz (own PFLINUX impls) are
 # deliberately NOT in the auto-port list.
 
 log() { mkdir -p "$(dirname "$LOG")"; printf '\n%s\n```sh\n%s\n```\n' "## $(date -Is) staging" "$*" >> "$LOG"; }
@@ -98,6 +99,8 @@ case "$cmd" in
 		port_c "$f" "pfsrc/${f##*/}";;
 	      netinet/ip_divert.c)
 		port_c "$f" "pfsrc/ip_divert.c";;
+	      crypto/md5.c|crypto/sha2.c)
+		port_c "$f" "compat/${f##*/}";;
 	    esac
 	  done
 	  ;;

scripts/vendorize.sh

@@ -10,7 +10,7 @@ SYS_K=(net/pf.c net/pf_ioctl.c net/pf_norm.c net/pf_if.c net/pf_lb.c net/pf_rule
        net/if_pflog.c net/if_pflog.h net/ifq.c net/ifq.h net/hfsc.c net/hfsc.h
        net/fq_codel.c net/fq_codel.h netinet/ip_divert.c netinet/ip_divert.h
        net/radix.c net/radix.h net/rtable.c net/rtable.h net/toeplitz.c net/toeplitz.h
-       crypto/sha2.c crypto/sha2.h crypto/siphash.c crypto/siphash.h
+       crypto/md5.c crypto/md5.h crypto/sha2.c crypto/sha2.h crypto/siphash.c crypto/siphash.h
        sys/tree.h sys/queue.h sys/param.h sys/hash.h sys/_endian.h sys/_lock.h)
 SRC_K=(sbin/pfctl/parse.y sbin/pfctl/pfctl.c sbin/pfctl/pfctl.h sbin/pfctl/pfctl_parser.c
        sbin/pfctl/pfctl_parser.h sbin/pfctl/pfctl_optimize.c sbin/pfctl/pfctl_print.c

scripts/vm-deploy.sh

@@ -42,10 +42,10 @@ log "staged on deb: $DEPLOY_DIR"
 vm_cmd "$(vm_ip pf0)" 'mkdir -p /opt/pf'
 if deb "command -v rsync" >/dev/null 2>&1 && \
    vm_cmd "$(vm_ip pf0)" 'command -v rsync' >/dev/null 2>&1; then
-  deb_cmd "rsync -a -e 'ssh -i $LAB_KEY_DEB ${SSH_OPTS[*]}' '$DEPLOY_DIR/' root@$(vm_ip pf0):/opt/pf/"
+  deb_cmd "rsync -a -e 'ssh -i $LAB_KEY_DEB $VMSSH_OPTS' '$DEPLOY_DIR/' root@$(vm_ip pf0):/opt/pf/"
 else
   # no rsync in guest: per-file scp
-  deb_cmd "for f in '$DEPLOY_DIR'/*; do scp -i $LAB_KEY_DEB ${SSH_OPTS[*]} -q \"\$f\" root@$(vm_ip pf0):/opt/pf/; done"
+  deb_cmd "for f in '$DEPLOY_DIR'/*; do scp -i $LAB_KEY_DEB $VMSSH_OPTS -q \"\$f\" root@$(vm_ip pf0):/opt/pf/; done"
 fi
 log "pf0:/opt/pf ->"
 vm_cmd "$(vm_ip pf0)" 'ls -l /opt/pf'

scripts/vm-destroy.sh

@@ -31,6 +31,7 @@ for a in $VMS; do
   deb_cmd "rm -rf '$SEED_DIR/$name' '$IMG_DIR/$name.qcow2' /tmp/$name.xml"
   log "removed domain+disk+seed: $name"
 done
+deb_cmd "rm -rf $SEED_DIR"
 rm -rf "$LAB_SEEDS"
 
 for n in "$NET_PF_LAN" "$NET_PF_WAN" "$NET_PF_WAN2"; do