docs: caveats EN+PT-BR updated to the verified state (hook order, soak, states, divert/pflog consumers)

tests/vm/08-routeto.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# M4 gate: route-to / dup-to — forced forwarding path (pf_route).
+#
+# Lab: cli (10.0.1.10) pings srv (10.0.2.20).  Without the rule pf0 forwards it
+# straight out eth2.  With `route-to { 10.0.3.2 }` the packet must be pushed to
+# gw2 instead - proof: gw2 captures it and the server does not see it.
+# Then `dup-to { 10.0.3.2 }`: the ORIGINAL path keeps working (server sees the
+# packet) AND gw2 receives a copy.
+set -uo pipefail; cd "$(dirname "$0")"; . ./lib.sh
+
+pf0 'insmod /opt/pf/pf.ko 2>/dev/null || insmod /tmp/pf.ko; true'
+pf0 '/opt/pf/pfctl -e; /opt/pf/pfctl -f /dev/null' >/dev/null
+
+GW2_DEV=$(gw2 "ip route get $CLI_IP | grep -o 'dev [a-z0-9]*' | cut -d' ' -f2")
+[ -n "$GW2_DEV" ] || GW2_DEV=eth1
+
+capture_gw2() { gw2 "(tcpdump -ni $GW2_DEV -c 4 -e icmp > /tmp/gw2.td 2>&1 &)" 2>/dev/null; }
+capture_srv() { srv "(tcpdump -ni eth1 -c 4 -e icmp > /tmp/srv.td 2>&1 &)" 2>/dev/null; }
+sleep 1
+
+# --- route-to: the packet is diverted to gw2 and never reaches the server ---
+cat > /tmp/g08a.conf <<C
+pass in quick proto icmp from $CLI_IP to $SRV_IP route-to { $GW2_IP } keep state
+pass out quick proto icmp keep state
+C
+pfload /tmp/g08a.conf || { bad "route-to rule load"; finish; }
+pf0 '/opt/pf/pfctl -sr' | grep -q 'route-to' && ok "route-to rule listed" || bad "route-to not listed"
+capture_gw2; capture_srv
+cli "ping -c2 -W2 $SRV_IP >/dev/null 2>&1"
+sleep 2
+gw2 'cat /tmp/gw2.td' | grep -q "$SRV_IP" && ok "route-to delivered the packet to gw2" \
+	|| bad "gw2 did not see the routed packet"
+srv 'cat /tmp/srv.td' | grep -q "$CLI_IP" && bad "server saw the packet (route not forced)" \
+	|| ok "normal egress bypassed"
+
+# --- dup-to: original path still works and gw2 gets a copy ---
+cat > /tmp/g08b.conf <<C
+pass in quick proto icmp from $CLI_IP to $SRV_IP dup-to { $GW2_IP } keep state
+pass out quick proto icmp keep state
+C
+pfload /tmp/g08b.conf || { bad "dup-to rule load"; finish; }
+pf0 '/opt/pf/pfctl -sr' | grep -q 'dup-to' && ok "dup-to rule listed" || bad "dup-to not listed"
+capture_gw2; capture_srv
+cli "ping -c2 -W2 $SRV_IP >/dev/null 2>&1" && ok "dup-to did not break the flow" \
+	|| bad "dup-to broke the transit ping"
+sleep 2
+srv 'cat /tmp/srv.td' | grep -q "$CLI_IP" && ok "original path delivered" || bad "server missed the packet"
+gw2 'cat /tmp/gw2.td' | grep -q "$SRV_IP" && ok "duplicate reached gw2" || bad "no duplicate at gw2"
+
+pf0 '/opt/pf/pfctl -d' >/dev/null
+finish