pf: Apply kif flags to new group members

[kp]

Summary

If we have a 'set skip on <ifgroup>' rule this flag it set on the group
kif, but must also be set on all members. pfctl does this when the rules
are set, but if groups are added afterwards we must also apply the flags
to the new member. If not, new group members will not be skipped until
the rules are reloaded.

Reported by: dvl@

[glebius]

sys/netpfil/pf/pf_if.c

496 ↗

(On Diff #66977)

The NULL check follows code in pf_test(), so let it be there. However, I believe NULL if_pf_kif isn't a normal situation, should be asserted to be not NULL as long as pf is loaded in kernel.

This comment is not blocking this revision. Just thinking that we should go over code and check whether all these checks need to be cleaned up.

[kp]

Thanks for the review.

I'll experiment with changing those checks into assertions in my tree.