pf: Add pfsync protocol for FreeBSD 15

[vegeta_tuxpowered.net]

Summary

A new version of pfsync packet is introduced: 1500. This version solves
the issues with data alignment introduced in version 1400 and adds syncing
of information needed to sync states created by rules with af-to (original
interface, af and proto separate for wire and stack keys), of rt_af
needed for prefer-ipv6-nexthop, and of tag names.

[kp]

sys/netpfil/pf/pf_ioctl.c

796

return (NULL)

[vegeta_tuxpowered.net]

Remove syncing of altq queue names, sync their IDs instead. The queue names are very long and if queues are kept identical on both routers, it will still work fine. Improve locking in tagname2tag().

[vegeta_tuxpowered.net]

sys/netpfil/pf/if_pfsync.c

838

Under which conditions can queues have different ids on two routers? Can this happen even if the ruleset is eventually identical but one of routers went though some intermediate versions? Syncing wrong information could send packets to a wrong queue, potentially some very slow one. Could we not sync it at all and trust the rule if rulesets are identical, like we did previously for other synced parameters? Or introduce a checksum just for altq queues?

tests/sys/netpfil/pf/pfsync.sh

1677

Note to self: add a test rt_af.

[kp]

sys/netpfil/pf/if_pfsync.c

838

I suspect the answer there is "If the rules/queues config has ever been different in those two pf instances".
I've not tested that, but given how tagname2tag() works. that's what I'd expect.

That's not ideal, but at least it's no more broken than it's ever been.

[vegeta_tuxpowered.net]

Fix struct alignment. Add a test for rt_af, document why it can't check all cases yet.

[vegeta_tuxpowered.net]

Update the man page for pfsync.

[vegeta_tuxpowered.net]

Fix the altq_queues test.