test(e2e): assert the §E.2 idle-silence window in every kernel scenario

The L2-anchor spec's behavioral guarantee — an idle link stays silent for
5 s once the enslavement burst settles — only ran in the Dynamips and
Docker suites. It now also runs in QEMU, IOU, the IOL container, the
switch fast path and the switch cascade, which covers every host-device
creation path:

* tap create (Dynamips/QEMU/IOU anchors), docker create_veth (Docker host
  ends; the cascade's race-loser end is hardened after create by the
  server), bridge add_nio_tap (the IOL container anchor, the fifth
  creator), and the brctl switch bridges, whose multicast snooping is off
  precisely so the bridge role can reach silence;
* each scenario silences its guests first (IOS interfaces shut through
  the console; Docker guests' links down) and re-verifies the ping after;
* the cascade measures 8 devices at once (four absorbed router anchors,
  both cascade ends, both switch bridges).

IOL 158 s, cascade 293 s, ESW fast path 378 s, QEMU 428 s, IOU 308 s —
all green.

tests/e2e/README.md

@@ -121,9 +121,11 @@ daemon socket the server itself uses.
 Every kernel scenario also asserts the L2-anchor spec's server-side
 guarantees (`docs/design/ubridge-l2-anchor-spec.md` §E): anchors and bridges
 carry no L3 identity (`assert_pure_l2`), joined ports are FORWARDING
-(`assert_forwarding`), and — in the Dynamips suite — an idle link with the
-guests silenced stays silent for 5 s (`assert_idle_silence`). These skip on
-a uBridge without `link l2only` (probed once by `harness.l2only_supported()`).
+(`assert_forwarding`), and an idle link with the guests silenced stays
+silent for 5 s (`assert_idle_silence`) — the guests are the IOS consoles'
+interfaces shut, the Docker guests' links down, or all four cascade routers
+silenced, whichever the scenario runs. These skip on a uBridge without
+`link l2only` (probed once by `harness.l2only_supported()`).
 
 Set `GNS3_E2E_DEBUG=1` to run the isolated instance with debug logging (the
 uBridge command stream lands in its `server.log`).

tests/e2e/test_ethernet_switch_cascade.py

@@ -34,6 +34,9 @@ off each switch. Real ICMP crossing both switches proves the datapath:
   Asymmetric flips are deliberately not tested: an access end egresses
   untagged, and the far trunk end would park those frames in its native
   VLAN — symmetric modes are the only sane inter-switch configuration;
+* the L2-anchor spec §E.2 silence window with all four router interfaces
+  shut: the absorbed anchors, both cascade ends and both switch bridges
+  stay silent for 5 s;
 * a ``delay 100`` filter lands as netem on BOTH veth ends (each direction
   impaired exactly once, like any two-sided kernel link) and the measured
   RTT grows by ~2 x 100 ms;
@@ -121,6 +124,19 @@ def _boot(server, project_id, node_id, timeout=360):
     return console
 
 
+def _eth_shutdown(console, shut):
+    """Shut/unshut both router interfaces on their switch links — the only
+    legitimate speakers on these segments (IOS's own CDP/keepalives) — for
+    §E.2's silence window; the addresses stay configured and answer once the
+    interfaces are back."""
+    console.run("conf t")
+    console.run("interface f1/0")
+    console.run("shutdown" if shut else "no shutdown")
+    console.run("interface f1/1")
+    console.run("shutdown" if shut else "no shutdown")
+    console.run("end")
+
+
 def test_ethernet_switch_cascade_kernel_datapath():
     server = harness.live_server(kernel=True)
     compute = server.compute
@@ -194,6 +210,22 @@ def test_ethernet_switch_cascade_kernel_datapath():
         baseline20 = harness.wait_ping(c1, IP20 % 2)
         assert baseline20["success"] == 100, baseline20["raw"]
 
+        # L2-anchor spec §E.2: with all four router interfaces shut, every
+        # host-side device of this fabric stays silent for 5 s — the four
+        # absorbed router anchors, both cascade ends and both switch bridges
+        # (the bridges are created with multicast snooping off precisely so
+        # the bridge role can reach silence, see uBridge's brctl create).
+        if harness.l2only_supported():
+            for console in (c1, c2):
+                _eth_shutdown(console, shut=True)
+            harness.assert_idle_silence(a1_10, a1_20, a2_10, a2_20, e0, e1, br1, br2)
+            for console in (c1, c2):
+                _eth_shutdown(console, shut=False)
+            assert harness.wait_ping(c1, IP10 % 2, attempts=5)["success"] == 100
+            assert harness.wait_ping(c1, IP20 % 2, attempts=5)["success"] == 100
+        else:
+            print(".. uBridge without link l2only: skipping the §E.2 assertion")
+
         # L2-anchor spec §E.1: the cascade ends and both bridges carry no L3
         # identity, and the bridged ends are FORWARDING.
         if harness.l2only_supported():

tests/e2e/test_ethernet_switch_kernel_datapath.py

@@ -24,6 +24,8 @@ Real ICMP crossing the switch proves the datapath:
   and defer the join; once the routers boot, the controller's re-push
   makes the switch join their anchors — the switch bridge's members become
   exactly the two router anchors (no relay TAPs anywhere);
+* the L2-anchor spec §E.2 silence window with both routers shut: the
+  absorbed anchors and the switch bridge stay silent for 5 s;
 * VLAN programming applies to absorbed anchors: different access VLANs
   isolate the routers (ping dies), the same VLAN bridges them again;
 * a ``delay 100`` filter lands as netem on the absorbed anchor (single
@@ -94,6 +96,16 @@ def _boot(server, project_id, node_id, timeout=360):
     return console
 
 
+def _eth_shutdown(console, shut):
+    """Shut/unshut the router's f1/0 — the only legitimate speaker on the
+    segment (IOS's own CDP/keepalives) — for §E.2's silence window; the
+    address stays configured and answers once it is back."""
+    console.run("conf t")
+    console.run("interface f1/0")
+    console.run("shutdown" if shut else "no shutdown")
+    console.run("end")
+
+
 def test_ethernet_switch_kernel_fast_path():
     server = harness.live_server(kernel=True)
     compute = server.compute
@@ -140,6 +152,19 @@ def test_ethernet_switch_kernel_fast_path():
         baseline = harness.wait_ping(c1, "10.1.1.2")
         assert baseline["success"] == 100, baseline["raw"]
 
+        # L2-anchor spec §E.2: with both routers shut, the absorbed anchors
+        # and the switch bridge stay silent for 5 s (the bridge is created
+        # with multicast snooping off precisely so the bridge role can).
+        if harness.l2only_supported():
+            for console in (c1, c2):
+                _eth_shutdown(console, shut=True)
+            harness.assert_idle_silence(a1, a2, sw_bridge)
+            for console in (c1, c2):
+                _eth_shutdown(console, shut=False)
+            assert harness.wait_ping(c1, "10.1.1.2", attempts=5)["success"] == 100
+        else:
+            print(".. uBridge without link l2only: skipping the §E.2 assertion")
+
         # L2-anchor spec §E.1: the absorbed anchors and the switch bridge
         # carry no L3 identity (skipped on a uBridge without `link l2only`),
         # and the joined ports are FORWARDING — the silent-failure guard.

tests/e2e/test_iol_docker_kernel_datapath.py

@@ -18,6 +18,9 @@ bridge, kernel filters, suspend and capture.
   (``ubridge_bridge_tap``); the anchors (``gx`` TAPs) exist from node start,
   before any link — and the per-link bridge enslaves exactly the two of them;
 * real ICMP crosses the [unix ↔ TAP] port bridge relay;
+* the L2-anchor spec §E.2 silence window with the guests shut — the
+  behavioral half of the hardening on an anchor created by uBridge's
+  bridge TAP module;
 * a ``delay 100`` filter lands as netem on both anchors, RTT grows ~200 ms;
 * the classifier spot check on a TAP anchor: ``bpf`` match-drop and the
   eBPF ``frequency_drop`` every-nth mode (the Docker suite runs the full
@@ -66,6 +69,16 @@ def _boot(server, project_id, node_id, timeout=BOOT_TIMEOUT):
     return console
 
 
+def _eth_shutdown(console, shut):
+    """Shut/unshut the guest's Ethernet0/0 — the only legitimate speaker on
+    the link segment (the IOL instance's own chatter) — for §E.2's silence
+    window; the address stays configured and answers once it is back."""
+    console.run("conf t")
+    console.run("interface Ethernet0/0")
+    console.run("shutdown" if shut else "no shutdown")
+    console.run("end")
+
+
 def _topology(compute, pid, image, name):
     n1 = compute.create_iol_router(pid, f"{name}-1", image)
     n2 = compute.create_iol_router(pid, f"{name}-2", image)
@@ -133,6 +146,21 @@ def test_iol_docker_kernel_datapath():
         baseline = harness.wait_ping(c1, "10.1.1.2")
         assert baseline["success"] == 100, baseline["raw"]
 
+        # L2-anchor spec §E.2: with the guests shut the anchors and the
+        # per-link bridge stay silent for 5 s. These anchors come from
+        # uBridge's bridge TAP module (`bridge add_nio_tap`) — the creator
+        # whose missing hardening the spec caught live; this is the
+        # behavioral half of that guarantee.
+        if harness.l2only_supported():
+            for console in (c1, c2):
+                _eth_shutdown(console, shut=True)
+            harness.assert_idle_silence(a1, a2, bridge)
+            for console in (c1, c2):
+                _eth_shutdown(console, shut=False)
+            assert harness.wait_ping(c1, "10.1.1.2", attempts=5)["success"] == 100
+        else:
+            print(".. uBridge without link l2only: skipping the §E.2 assertion")
+
         # delay 100: netem on both anchors (each impairs one direction),
         # one-way ~100 ms => RTT grows by ~200 ms
         compute.call("PUT", f"/projects/{pid}/links/{lid}", {"filters": {"delay": [100]}})

tests/e2e/test_iou_kernel_datapath.py

@@ -20,6 +20,7 @@ Linux bridge, kernel filters, suspend and capture.
   bay/unit) exist from node start, before any link — and the per-link
   bridge enslaves exactly the two of them;
 * real ICMP crosses the [IOL fabric ↔ TAP] port bridge;
+* the L2-anchor spec §E.2 silence window with the guests shut;
 * a ``delay 100`` filter lands as netem on both anchors, RTT grows ~200 ms;
 * the classifier spot check on a TAP anchor: ``bpf`` match-drop and the
   eBPF ``frequency_drop`` every-nth mode (the Docker suite runs the full
@@ -81,6 +82,16 @@ def _boot(server, project_id, node_id, timeout=BOOT_TIMEOUT):
     return console
 
 
+def _eth_shutdown(console, shut):
+    """Shut/unshut the guest's Ethernet0/0 — the only legitimate speaker on
+    the link segment (the IOL fabric's own chatter) — for §E.2's silence
+    window; the address stays configured and answers once it is back."""
+    console.run("conf t")
+    console.run("interface Ethernet0/0")
+    console.run("shutdown" if shut else "no shutdown")
+    console.run("end")
+
+
 def test_iou_kernel_datapath():
     server = harness.live_server(kernel=True)
     compute = server.compute
@@ -147,6 +158,19 @@ def test_iou_kernel_datapath():
         baseline = harness.wait_ping(c1, "10.1.1.2")
         assert baseline["success"] == 100, baseline["raw"]
 
+        # L2-anchor spec §E.2: with the guests shut the anchors and the
+        # per-link bridge stay silent for 5 s (these anchors are the `tap
+        # create` persistent TAPs, one per Ethernet bay/unit).
+        if harness.l2only_supported():
+            for console in (c1, c2):
+                _eth_shutdown(console, shut=True)
+            harness.assert_idle_silence(a1, a2, bridge)
+            for console in (c1, c2):
+                _eth_shutdown(console, shut=False)
+            assert harness.wait_ping(c1, "10.1.1.2", attempts=5)["success"] == 100
+        else:
+            print(".. uBridge without link l2only: skipping the §E.2 assertion")
+
         # delay 100: netem on both anchors (each impairs one direction),
         # one-way ~100 ms => RTT grows by ~200 ms
         compute.call("PUT", f"/projects/{pid}/links/{lid}", {"filters": {"delay": [100]}})

tests/e2e/test_qemu_kernel_datapath.py

@@ -19,6 +19,8 @@ port bridge, the anchor is the NIC's host side.
   anchors (``gq`` TAPs, one per adapter) exist from node start, before any
   link — and the per-link bridge enslaves exactly the two of them;
 * real ICMP crosses the [QEMU netdev ↔ TAP] anchor;
+* the L2-anchor spec §E.2 silence window with the guests shut (the anchors
+  here are QEMU's own netdevs);
 * a ``delay 100`` filter lands as netem on both anchors, RTT grows ~200 ms;
 * suspend admin-downs the anchor (the e1000 loses carrier) and kills the
   traffic; resume restores;
@@ -80,6 +82,16 @@ def _boot(server, project_id, node_id, timeout=BOOT_TIMEOUT):
     return console
 
 
+def _eth_shutdown(console, shut):
+    """Shut/unshut the guest's GigabitEthernet0/0 — the only legitimate
+    speaker on the link segment (IOSv's own chatter) — for §E.2's silence
+    window; the address stays configured and answers once it is back."""
+    console.run("conf t")
+    console.run(f"interface {GUEST_ETH_IF}")
+    console.run("shutdown" if shut else "no shutdown")
+    console.run("end")
+
+
 def test_qemu_kernel_datapath():
     server = harness.live_server(kernel=True)
     compute = server.compute
@@ -144,6 +156,18 @@ def test_qemu_kernel_datapath():
         baseline = harness.wait_ping(c1, "10.1.1.2")
         assert baseline["success"] == 100, baseline["raw"]
 
+        # L2-anchor spec §E.2: with the guests shut the anchors (QEMU's own
+        # netdevs) and the per-link bridge stay silent for 5 s.
+        if harness.l2only_supported():
+            for console in (c1, c2):
+                _eth_shutdown(console, shut=True)
+            harness.assert_idle_silence(a1, a2, bridge)
+            for console in (c1, c2):
+                _eth_shutdown(console, shut=False)
+            assert harness.wait_ping(c1, "10.1.1.2", attempts=5)["success"] == 100
+        else:
+            print(".. uBridge without link l2only: skipping the §E.2 assertion")
+
         # delay 100: netem on both anchors (each impairs one direction),
         # one-way ~100 ms => RTT grows by ~200 ms
         compute.call("PUT", f"/projects/{pid}/links/{lid}", {"filters": {"delay": [100]}})