Add netgraph BFP rc.d script

[rozhuk.im-gmail.com]

Summary

This script allow attach to any ng_ether capable network interface BFP filters with tcpdump syntax.

For example, I use it at home to drop evil TCP RST packets that my ISP send to block access to some sites:
ng_bpf_enable="YES"
ng_bpf_profiles="vlan886"
ng_bpf_vlan886_in="ip and tcp and ip[6] & 64 = 0 and ip[8]>128 and tcp[tcpflags] == tcp-rst"

Also this can filter any L2 traffic.

[donner]

First I'm happy to see such a sophisticated use of netgraph in the default rc context.
Thank you for this idea.

May I ask you to provide a full context diff, please?
It's much easier to review.

May you please add a paragraph to the rc man page, too?

libexec/rc/rc.d/ng_bpf

99

Where is the variable pidfile used?

[rozhuk.im-gmail.com]

In D30175#693715, @donner wrote:

May I ask you to provide a full context diff, please?
It's much easier to review.

If you mean: "why I do this" - because my internet service provider block some sites.
For block https provider send 3 fake tcp rst packets. My home router is FBSD based and only PF used. PF can not block (or I do not dig enough) and I do not want use ipfw only for this.

May you please add a paragraph to the rc man page, too?

I am not native speaker, it is a bit hard to me to write for humans.

libexec/rc/rc.d/ng_bpf

99

In /etc/rc.subr, like other sripts: /etc/rc.d/tlsservd (example)

[donner]

Thank you for adding context to the diff.

libexec/rc/rc.d/ng_bpf

99

pidfile is only used for the default "stop" and "status" functions. Because there are explicit functions available, pidfile will never be used. It will never be filled on disk, so the variable causes confusion. Please remove it.

[donner]

In D30175#694137, @rozhuk.im-gmail.com wrote:

In D30175#693715, @donner wrote:

May you please add a paragraph to the rc man page, too?

I am not native speaker, it is a bit hard to me to write for humans.

This does not matter. Others will rephrase your input, if necessary.

[zarychtam_plan-b.pwste.edu.pl]

This script looks very promising, but it won't be easy to fulfill all committers' needs, but perhaps it would be easier to make it available as a port, for example, net-mgmt/ng_bpf_firewall ?