test(vlan): add dual-vlan + vip_addr + ipfw_pr config-layer functional test harness

Implements a 4-sub-agent harness (spec-writer / coder / reviewer / gate-keeper)
to verify that f-stack vlan section parsing, if_clone_create, vip_addr setup,
and ipfw_pr rule installation all succeed at primary startup with a dual-vlan
multi-tenant config — without breaking the FreeBSD 13.0 -> 15.0 upgrade work.

Scope: config-layer acceptance only (per task scope D). End-to-end e2e tests
(loopback ping vip / client 802.1Q HTTP) are tracked as F-V1/F-V2 follow-ups.

Verified against runtime helloworld primary at 2026-06-09 11:45 (pid 2349497):
  - vlan1 (192.169.0.0/24) and vlan2 (192.169.1.0/24) if_clone_create both OK:
      f-stack-0.1: Successed to if_clone_create vlan interface
      f-stack-0.2: Successed to if_clone_create vlan interface
  - ipfw rules installed and queryable via tools/sbin/ipfw:
      00010  setfib 0 ip from 192.169.0.0/24 to any out   (vlan_idx=0)
      00020  setfib 1 ip from 192.169.1.0/24 to any out   (vlan_idx=1)
    fib_num matches ff_veth.c:949 'fib_num = vlan_cfg->vlan_idx' exactly.
  - No vip/addr/ipfw setup errors in helloworld log.
  - 13.0 -> 15.0 vlan_cfg_handler diff is empty; no regression.

Files added:
  config.test-vlan.ini                         dual-vlan test config (do not
                                               replace production config.ini;
                                               selected explicitly via -c)
  tools/sbin/vlan_test_orchestrator.sh         leader entry point
  tools/sbin/vlan_test_validate.sh             G1/G2/G3/G4 gate implementation
                                               (G2 uses setsid + </dev/null
                                               detach to avoid sudo+subshell
                                               do_wait hang previously seen)
  tools/sbin/.gitignore                        whitelist the two scripts above
  docs/.../vlan-vip-ipfw-test-plan.md          harness plan (roles, gates,
                                               escalation policy)
  docs/.../vlan-vip-ipfw-test-spec.md          spec (TC-V1..V5, risk register,
                                               cross-source check matrix)
  docs/.../vlan-vip-ipfw-test-execution-log.md execution trace (BOUNCE=0/3,
                                               hang root cause + fix, full
                                               gate output, follow-up list)

Compliance: zero direct rm/kill/chmod calls. All cleanup goes through
/data/workspace/{rm_tmp_file,kill_process,chmod_modify}.sh wrappers.

Local commit only; no push (per phase-2/phase-5b/F-A1 convention).

Author: vlan-test-harness

config.test-vlan.ini

@@ -0,0 +1,355 @@
+[dpdk]
+# Hexadecimal bitmask of cores to run on.
+lcore_mask=10
+
+# Number of memory channels.
+channel=4
+
+# Specify base virtual address to map.
+#base_virtaddr=0x7f0000000000
+
+# Promiscuous mode of nic, defualt: enabled.
+promiscuous=1
+numa_on=1
+
+# TX checksum offload skip, default: disabled.
+# We need this switch enabled in the following cases:
+# -> The application want to enforce wrong checksum for testing purposes
+# -> Some cards advertize the offload capability. However, doesn't calculate checksum.
+tx_csum_offoad_skip=0
+
+# TCP segment offload, default: disabled.
+tso=0
+
+# HW vlan strip, default: enabled.
+vlan_strip=1
+
+# Set [vlanN]'s addrs like [portN] later
+# the format is same as port_list
+# Set vlan filter id, to enable L3/L4 RSS below vlan hdr is not enable after f-stack-1.22.
+# vlan-test 2026-06-09: enabled to match [vlan1]+[vlan2] sections below.
+vlan_filter=1,2
+
+# sleep when no pkts incomming
+# unit: microseconds
+idle_sleep=20
+
+# sent packet delay time(0-100) while send less than 32 pkts.
+# default 100 us.
+# if set 0, means send pkts immediately.
+# if set >100, will dealy 100 us.
+# unit: microseconds
+pkt_tx_delay=100
+
+# use symmetric Receive-side Scaling(RSS) key, default: disabled.
+symmetric_rss=0
+
+# PCI device enable list.
+# And driver options
+#allow=02:00.0
+# for multiple PCI devices
+#allow=02:00.0,03:00.0
+
+# enabled port list
+#
+# EBNF grammar:
+#
+#    exp      ::= num_list {"," num_list}
+#    num_list ::= <num> | <range>
+#    range    ::= <num>"-"<num>
+#    num      ::= '0' | '1' | '2' | '3' | '4' | '5' | '6' | '7' | '8' | '9'
+#
+# examples
+#    0-3       ports 0, 1,2,3 are enabled
+#    1-3,4,7   ports 1,2,3,4,7 are enabled
+#
+# If use bonding, shoule config the bonding port id in port_list
+# and not config slave port id in port_list
+# such as, port 0 and port 1 trank to a bonding port 2,
+# should set `port_list=2` and config `[port2]` section
+
+port_list=0
+
+# Number of vdev.
+nb_vdev=0
+
+# Number of bond.
+nb_bond=0
+
+# log level for dpdk, optional
+#log_level=8
+
+# Log file level and prefix of F-Stack lib and FreeBSD.
+#    fstack_log_level: 0-8, default 0.
+#        0 : means disable log file, and output to stdout/stderr/syslog(/var/log/message), etc.
+#        1-8 : log level, same to DPDK's log level, equal to system's log levle + 1.
+#              1 = EMERG
+#              2 = ALERT
+#              3 = CRIT
+#              4 = ERR
+#              5 = WARNING
+#              6 = NOTICE
+#              7 = INFO
+#              8 = DEBUG
+#    fstack_log_file_prefix : log file prefix, and <proc_id> will splice with prefix, such as "./f-stack-0".
+#fstack_log_level=0
+#fstack_log_file_prefix=./f-stack-
+
+
+# Each core write into own pcap file, which is open one time, close one time if enough.
+# Support dump the first snaplen bytes of each packet.
+# if pcap file is lager than savelen bytes, it will be closed and next file was dumped into.
+[pcap]
+enable=0
+snaplen=96
+savelen=16777216
+savepath=.
+
+# Port config section
+# Correspond to dpdk.port_list's index: port0, port1...
+[port0]
+addr=9.134.214.176
+netmask=255.255.248.0
+broadcast=9.134.215.255
+gateway=9.134.208.1
+# set interface name, Optional parameter.
+#if_name=eno7
+
+# IPv6 net addr, Optional parameters.
+#addr6=ff::02
+#prefix_len=64
+#gateway6=ff::01
+
+# Multi virtual IPv4/IPv6 net addr, Optional parameters.
+#       `vip_ifname`: default `f-stack-x`
+#       `vip_addr`: Separated by semicolons, MAX number 64;
+#                   Only support netmask 255.255.255.255, broadcast x.x.x.255 now, hard code in `ff_veth_setvaddr`.
+#       `ipfw_pr`: Set simplest policy routing,  Optional parameters.
+#                  Such as the cmd `ff_ipfw -P 0 add 100 setfib 0 ip from 192.168.0.0/24 to any out`
+#                  can set parameter`192.168.0.0 255.255.255.0`, cidr and netmask separated by space.
+#                  Multi cidr separated by semicolons.
+#                  IPv4 only now, and if you want set more complex policy routing, should use tool `ff_ipfw`.
+#       `vip_addr6`: Separated by semicolons, MAX number 64.
+#       `vip_prefix_len`: All addr6 use the same prefix now, default 64.
+#vip_ifname=lo0
+#vip_addr=192.168.0.3;192.168.0.4;192.168.0.5;192.168.0.6
+#ipfw_pr=192.168.0.0 255.255.255.0;192.168.10.0 255.255.255.0
+#vip_addr6=ff::03;ff::04;ff::05;ff::06;ff::07
+#vip_prefix_len=64
+
+# lcore list used to handle this port
+# the format is same as port_list
+#lcore_list=0
+
+# bonding slave port list used to handle this port
+# need to config while this port is a bonding port
+# the format is same as port_list
+#slave_port_list=0,1
+
+# Vlan config section, Must set after all [portN]
+# NOTE1: Must enable dpdk.vlan_filter first, and match it.
+# NOTE2: If enable vlan config, all [PortN] config will be ignored!
+#
+# vlan-test 2026-06-09: dual-vlan multi-tenant scenario.
+# vlanid 1/2 must be in dpdk.vlan_filter (already set to "1,2" above).
+# 192.169.0.0/24 + 192.169.1.0/24 do NOT collide with production
+# 9.134.214.0/21 (port0). When this config is loaded, port0 [portN]
+# settings are intentionally skipped per ff_veth.c:868.
+
+[vlan1]
+portid=0
+addr=192.169.0.2
+netmask=255.255.255.0
+broadcast=192.169.0.255
+gateway=192.169.0.1
+vip_addr=192.169.0.3;192.169.0.4
+ipfw_pr=192.169.0.0 255.255.255.0
+
+[vlan2]
+portid=0
+addr=192.169.1.2
+netmask=255.255.255.0
+broadcast=192.169.1.255
+gateway=192.169.1.1
+vip_addr=192.169.1.3;192.169.1.4
+ipfw_pr=192.169.1.0 255.255.255.0
+
+# Other [vlanN] templates kept commented as documentation reference:
+#[vlan4]
+#portid=0
+#addr=192.169.2.2
+#netmask=255.255.255.0
+#broadcast=192.169.2.255
+#gateway=192.169.2.1
+#
+#vip_addr=192.169.2.3;192.169.2.4;192.169.2.5;192.169.2.6
+#ipfw_pr=192.169.2.0 255.255.255.0;192.169.12.0 255.255.255.0
+#
+#[vlan4]
+#portid=0
+#addr=192.169.2.2
+#netmask=255.255.255.0
+#broadcast=192.169.2.255
+#gateway=192.169.2.1
+#
+#vip_addr=192.169.2.3;192.169.2.4;192.169.2.5;192.169.2.6
+#ipfw_pr=192.169.2.0 255.255.255.0;192.169.12.0 255.255.255.0
+#
+#[vlan5]
+#portid=0
+#addr=192.169.3.2
+#netmask=255.255.255.0
+#broadcast=192.169.3.255
+#gateway=192.169.3.1
+#
+#addr6=fe::32
+#prefix_len=64
+#gateway6=fe::31
+#
+#vip_addr=192.169.3.3;192.169.3.4;192.169.3.5;192.169.3.6
+#ipfw_pr=192.169.3.0 255.255.255.0;192.169.13.0 255.255.255.0
+#vip_addr6=fe::33;fe::34;fe::35;fe::36;fe::37
+#vip_prefix_len=64
+
+# Vdev config section
+# orrespond to dpdk.nb_vdev's index: vdev0, vdev1...
+#    iface : Shouldn't set always.
+#    path : The vuser device path in container. Required.
+#    queues : The max queues of vuser. Optional, default 1, greater or equal to the number of processes.
+#    queue_size : Queue size.Optional, default 256.
+#    mac : The mac address of vuser. Optional, default random, if vhost use phy NIC, it should be set to the phy NIC's mac.
+#    cq : Optional, if queues = 1, default 0; if queues > 1 default 1.
+#[vdev0]
+##iface=/usr/local/var/run/openvswitch/vhost-user0
+#path=/var/run/openvswitch/vhost-user0
+#queues=1
+#queue_size=256
+#mac=00:00:00:00:00:01
+#cq=0
+
+# bond config section
+# See http://doc.dpdk.org/guides/prog_guide/link_bonding_poll_mode_drv_lib.html
+#[bond0]
+#mode=4
+#slave=0000:0a:00.0,slave=0000:0a:00.1
+#primary=0000:0a:00.0
+#mac=f0:98:38:xx:xx:xx
+## opt argument
+#socket_id=0
+#xmit_policy=l23
+#lsc_poll_period_ms=100
+#up_delay=10
+#down_delay=50
+
+# ff_rss_check table config section
+# To enable or disable static ff_rss_check table.
+# If enable it, F-Stack will init the table while the APP is starting.
+# Then the APP connect to a sever as client, it will try select a local port from the inited table first.
+#
+# This feature will greatly improve the performance of selecting local port
+# when the F-Stack application actively access remote services as a client and not set keep-alive.
+# If the local port is idle, it only needs to be selected once,
+# and no longer needs to be selected multiple times (the average number of times is about the total number of processes).
+# And the performance of selecting available local ports at a time is also improved compared to ff_rss_check().
+# If get rss local port failed, it will be fallback to ff_rss_check().
+#
+#    enable : 0 means disable, 1 means enable. Default 0.
+#    rss_tbl : Set 4-tuple for ff_rss_check table, Required argumnet.
+#              <porit_id> <daddr(local addr)> <saddr(remote addr)> <sport(remote port)>
+#              Separated by space in one 4-tuple, and separated by semicolon between multi 4-tuples.
+#              The max supported num of 2-tuple with saddr and sport is 4 * 4 = 16.
+#              The max supported num of daddr with one same saddr and sport is 4.
+#              So the max combination num of 4-tuple is 16 * 4 = 64, other config will be ignored.
+[rss_check]
+enable=0
+rss_tbl=0 192.168.1.1 192.168.2.1 80;0 192.168.1.1 192.168.2.1 443
+
+# Kni config: if enabled and method=reject,
+# all packets that do not belong to the following tcp_port and udp_port
+# will transmit to kernel; if method=accept, all packets that belong to
+# the following tcp_port and udp_port will transmit to kernel.
+#[kni]
+#enable=1
+#method=reject
+## The format is same as port_list
+#tcp_port=80,443
+#udp_port=53
+# KNI ratelimit value, default: 0, means disable ratelimit.
+# example:
+# The total speed limit for a single process entering the kni ring is 10,000 QPS,
+# 1000 QPS for general packets, 9000 QPS for console packets (ospf/arp, etc.)
+# The total speed limit for kni forwarding to the kernel is 20,000 QPS.
+#console_packets_ratelimit=0
+#general_packets_ratelimit=0
+#kernel_packets_ratelimit=0
+
+# FreeBSD network performance tuning configurations.
+# Most native FreeBSD configurations are supported.
+[freebsd.boot]
+# If use rack/bbr which depend HPTS, you should set a greater value of hz, such as 1000000 means a tick is 1us.
+hz=100
+
+# Block out a range of descriptors to avoid overlap
+# with the kernel's descriptor space.
+# You can increase this value according to your app.
+fd_reserve=1024
+
+kern.ipc.maxsockets=262144
+
+net.inet.tcp.syncache.hashsize=4096
+net.inet.tcp.syncache.bucketlimit=100
+
+net.inet.tcp.tcbhashsize=65536
+
+kern.ncallout=262144
+
+kern.features.inet6=1
+
+[freebsd.sysctl]
+kern.ipc.somaxconn=32768
+kern.ipc.maxsockbuf=16777216
+
+net.add_addr_allfibs=1
+
+net.link.ether.inet.maxhold=5
+
+net.inet.tcp.fast_finwait2_recycle=1
+net.inet.tcp.finwait2_timeout=5000
+net.inet.tcp.maxtcptw=128
+net.inet.tcp.sendspace=16384
+net.inet.tcp.recvspace=8192
+#net.inet.tcp.nolocaltimewait=1
+net.inet.tcp.cc.algorithm=cubic
+net.inet.tcp.sendbuf_max=16777216
+net.inet.tcp.recvbuf_max=16777216
+net.inet.tcp.sendbuf_auto=1
+net.inet.tcp.recvbuf_auto=1
+net.inet.tcp.sendbuf_inc=16384
+#net.inet.tcp.recvbuf_inc=524288
+net.inet.tcp.sack.enable=1
+net.inet.tcp.blackhole=1
+net.inet.tcp.msl=2000
+net.inet.tcp.delayed_ack=1
+net.inet.tcp.rfc1323=1
+
+net.inet.udp.blackhole=1
+net.inet.ip.redirect=0
+net.inet.ip.forwarding=0
+net.inet.ip.portrange.randomized=1
+# Always do random while connect to remote server.
+# In some scenarios of F-Stack application, the performance can be improved to a certain extent, ablout 5%.
+net.inet.ip.portrange.randomtime=0
+
+net.inet6.ip6.auto_linklocal=1
+net.inet6.ip6.accept_rtadv=2
+net.inet6.icmp6.rediraccept=1
+net.inet6.ip6.forwarding=0
+
+# set default stacks:freebsd, rack or bbr, may be you need increase the value of parameter 'freebsd.boot.hz' while use rack or bbr.
+net.inet.tcp.functions_default=freebsd
+# need by bbr, should enable it.
+net.inet.tcp.hpts.skip_swi=1
+# Interval between calls to hpts_timeout_dir. default min 250us, max 256-512ms, default 512ms.
+net.inet.tcp.hpts.minsleep=250
+# [25600-51200]
+net.inet.tcp.hpts.maxsleep=51200