ipfilter: Set ipf -T optionlist at boot

[cy]

Summary

There is no easy way to set ipfilter optionlist variables during boot.
Add plumbing to the rc script to support this.

Original by: G. Paul Ziemba <[e-mail]>
PR: 130555
MFC 1 week

Test Plan

Running here

[jlduran]

libexec/rc/rc.d/ipfilter

37

I believe this should now be:

if ${ipfilter_program:-/sbin/ipf} -V | grep -q 'Running: yes'; then

Reference: 854cb10a5882ba2577bafb8eea9a1e383315f53e

[cy]

Fixed, plus another change.

libexec/rc/rc.d/ipfilter

37

You're indeed correct. Thanks for reminding me.

[cy]

This update makes the following changes:

1. It fixes the issue jlduran pinted out.
2. It reduces the check for ipfilter running by one grep.

[jlduran]

I would have just added:

if [ -n "${ifilter_optionlist}" ]; then
	if ${ipfilter_program:-/sbin/ipf} -V | grep -q 'Running: yes'; then
		${ipfilter_program:-/sbin/ipf} -D
	fi
	${ipfilter_program:-/sbin/ipf} -T "${ipfilter_optionlist}"
fi

But the current code does the job well and it's arguably more explicit.

[jlduran]

Sorry, thinking more about it, this is essentially an rc patch.
The start action will always restart if there is an ipfilter_optionlist defined. Two questions:

1. Can ipfilter rely more on rc.subr?
2. If i understand 130555 wouldn't this want an extra action?

EDIT: Not suggesting that it should be changed/added in this review.

[cy]

In D47346#1080517, @jlduran wrote:

Sorry, thinking more about it, this is essentially an rc patch.
The start action will always restart if there is an ipfilter_optionlist defined. Two questions:

1. Can ipfilter rely more on rc.subr?

No. Unless ipfilter options can/should be shared with other rc scripts, this is specific to ipfilter.

2. If i understand 130555 wouldn't this want an extra action?

EDIT: Not suggesting that it should be changed/added in this review.

The PR just wants ipfilter options to be set at boot. One could do it as in this revision or a new rc script. Best to be done here, as one could change the optionlist and service ipfilter restart.