pf: Create a kif for flags

[kp]

Summary

If userspace tries to set flags (e.g. 'set skip on <ifspec>') and
<ifspec> doesn't exist we should create a kif so that we apply the flags
when the <ifspec> does turn up.

Otherwise we'd end up in surprising situations where the rules say the
interface should be skipped, but it's not until the rules get
re-applied.

[donner]

sys/netpfil/pf/pf_if.c

822

How do you ensure, that the kif structure is not attached multiple times?
How do you ensure, that the old data is not lost?
Who will free the allocated memory?

[kp]

sys/netpfil/pf/pf_if.c

822

pfi_kif_attach() does a pfi_kif_find(), and if it finds a kif with the same name it will free the new kif and return the existing one, That's why we do kif = phi_kif_attach(kif, name);. The kif in the argument and the returned kif may be different objects.

This change essentially only matters in one case: when pfctl provides a name for an interface or group which doesn't exist (yet). That's the only case where we'll allocate and keep the new kif.

Conversely, when we clear flags (in the second part of this patch) we check if the kif still has any reason to exist, i.e. there's a corresponding interface or group, or there are flags to remember. If none of those conditions are met there's no reason to keep the kif around, and we free it.

[donner]

sys/netpfil/pf/pf_if.c

847

Wording: "delete this kif."