Fix IPv6 flow label match in ipfw

[lytboris_gmail.com]

Summary

Address a number of IPv6 flow label bugs scattered across different parts of ipfw:

• kernel module: IPV6_FLOWLABEL_MASK is not being applied before comparison in flow6id_match() so flow-id opcode never matches a flow label alone (one need to take protocol version and traffic class into account)
• kernel module: off-by-one bug leading to out-of-bounds read
• sbin/ipfw: flow-id opcode allows just ip6 as a proto while ipv6-icmp, tcp, udp should be fine too.

Test Plan

ipv6-flow-id.sh test is provided

[pouria]

I'm not an expert on IPFW. But the code, and logic LGTM.

tests/sys/netpfil/ipfw/ipv6-flow-id.sh

2–28

Please use new format.
recently, @ziaee updated the preferred format:
https://docs.freebsd.org/en/articles/license-guide/

Even that - at the first line is no longer required.

43

Could be nice to use ifconfig -j instead. Of course, I understand this pattern is repeated across the ipfw tests.

tests/sys/netpfil/ipfw/lookup.sh

59 ↗

(On Diff #177369)

This is not really related to this change.
I suggest to separate it into another commit/review.

144 ↗

(On Diff #177369)

This is not really related to this change.
I suggest to separate it into another commit/review.