test: put fw on a wire, with another machine on the other end

Everything in fwtest.rc happens on one machine, which is as far as it
goes: it can take a spare card and watch what fw does to the
interfaces, but it cannot make a neighbour send anything.  Four things
were listed as never tested for that reason.  Three of them now are.

run.sh -gw and -lan join two VMs into a point-to-point segment, so the
peer is a plain overlay of the base with an address and nothing else.

ARP first, since it is the part with no other explanation: the stack
that owns 10.9.9.1 has a pkt interface and no ethernet, so nothing else
on that segment can answer for it.  The peer's arp table:

	ether  OK   10.9.9.1     52540087c8c1     10.9.9.2

which is the firewall's card.  The first ping takes about a second and
the rest are sub-millisecond -- fw ARPing for the peer before it can
reply, and dropping the first one while it asks, which is the drop no
rule caused in fw(8) BUGS, until now only reasoned about.

Then filtering as against forwarding, which cannot be seen from inside
at all.  With allow=in proto=icmp alone, a TCP connect from the peer
sits for 290 seconds and times out; prepend a rule through ctl and the
same connect is refused in 2.  Refused is the far stack's RST, so the
packet arrived; timed out is fw dropping it in silence.

And frames addressed to somebody else, which is the commit that shipped
saying it could not be tested without a second machine.  A stack only
addresses frames to the mac it resolved, so rawether.c forges one.  A
promiscuous reader on the firewall machine sees both frames, which had
to be confirmed first -- a frame that never arrived looks exactly like
one that was filtered, and my first attempt at this drew the wrong
conclusion from precisely that.  Same rig, same frames, same rules:

	                 to fw's card   to nobody's
	no check              +3            +3
	with the check        +2             0

test/wire.md is the procedure, including the two ways I wasted time:
fw's control files need -s to be reachable from another shell, and
anything that leaves fw holding a pipe waits forever for a program that
has already detached.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 28 insertions, 10 deletions

diff --git a/fw/doc/todo.md b/fw/doc/todo.md
index 6c39e9b..e83167d 100644
--- a/fw/doc/todo.md
+++ b/fw/doc/todo.md
@@ -137,21 +137,39 @@ FAILURE in `fw(8)`. The tests assert it in card and namespace mode,
 because it is exactly the kind of property a later helpful change would
 reverse without meaning to.
 
+## Tested on a wire
+
+Two VMs on one ethernet segment, `run.sh -gw` and `-lan`; the procedure
+is `test/wire.md` and it is worth keeping, because none of this can be
+seen from one machine.
+
+- **ARP for an address whose card has been taken.** The peer's arp
+  table says `10.9.9.1 → 52540087c8c1`, which is the firewall's card
+  and not the peer's own. Nothing else could have answered.
+- **The first packet to an unresolved hop is dropped**, exactly as
+  fw(8) BUGS says: first ping ~1s while fw ARPs for the peer, the rest
+  sub-millisecond.
+- **Filtering rather than forwarding.** `allow=in proto=icmp` alone:
+  ping works, TCP sits for 290 seconds and times out. Add the rule
+  through `ctl` and the same connect is refused in 2 seconds — refused
+  is the far stack's RST, so the packet arrived.
+- **Frames addressed to somebody else are ignored.** Forged with
+  `test/rawether.c`. With the destination check the counter does not
+  move; without it, a frame for nobody is judged exactly like one for
+  us.
+
 ## Never tested
 
-- **The wire side of card mode.** The suite can take a spare card — it
-  does, and everything up to the wire is now covered — but it cannot
-  make a neighbour send to it. Anything that depends on another machine
-  on the same segment is unproven: the destination-address filter, ARP
-  against a real peer, broadcast.
-- **Broadcast handling.** Written, reviewed, never observed crossing
-  `fw`. The mapping is the standard one and normal traffic is
-  unaffected.
+- **Broadcast handling.** Written, reviewed, still never observed
+  crossing `fw`. The rig above could now show it — a broadcast from the
+  peer is one `rawether` call away — and it has not been done.
 - **IPv6 traffic**, in any mode. Under `-e` it cannot work at all:
   there is no neighbour discovery, so v6 unicast is dropped. IPv6
   extension headers are not walked, so v6 fragments do not cross.
-- **The gateway with two real machines**, and a real second NIC
-  carrying real traffic.
+- **The gateway between two real machines.** The wire rig proves card
+  mode; the gateway has still only been run between two synthetic
+  stacks on one machine.
+- **A real NIC on real hardware**, as against an emulated e1000.
 
 ## Deliberately not doing