libifconfig and libpfctl look fine to me.

In D52234#1193199, @guest-svmhdvn wrote:

Instead of skipping these and keeping around lots of code to check the ovpn version, why not just temporarily xfail them like I've done in the attached patch of https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289150? That way, once Ports contains ovpn>=2.7, these tests will automatically start failing again with the message "failed: expected failure, but none found". We can remove the xfails promptly afterwards.

Also not something that must be done in this commit, but we should modify sbin/ifconfig to the new functions. That'll remove a little more code from ifconfig and it'll mean we test this code (as part of any test that runs ifconfig foo up).

The commit message needs to answer the "Why?".
Why are we bypassing the reference counting?

Looks good, other than these minor remarks.

A quick pfctl test case for the parser changes (i.e. just a simple prefer-ipv6-nexthop route-to line) would be nice to have too.

In D51871#1185506, @obiwac wrote:

Linux is actually doing something based on ifi_change currently (relevant code in net/core/rtnetlink.c, rtnl_dev_combine_flags).

Ah yes, "Documentation does not match reality", that's what I was missing. I did not check Linux code, I only looked at our tree.

So that seems correct if ifi_change lists the changed flags we should look at.

In D51778#1185229, @hrs wrote:

I am also curious about why the PPPoE implementation sticks to only /128 LLAs for the link. When creating a pppoe interface as IPv6-capable one, it should get a /64 LLA because of AUTO_LINKLOCAL flag. Does pfSense disable this address assignment?

LGTM. Absent objections in the next day or two I'll commit this.

First impressions are that this makes sense, and removes a lot of 'route-to' special casing from code that ideally shouldn't have to know about route-to.

Tests look good, but of course only commit them once the fix lands too.

In D51789#1183132, @vegeta_tuxpowered.net wrote:

In D51789#1183098, @kp wrote:

No objection, but things just build even on LINT-NOINET6 kernels without this change, so I'm not sure what the motivation is.

I've seen such ifdefs around code in other places in pf, AFAIR the commits were labelled as "fix build without IPv4", so I thought it's always necessary.

No objection, but things just build even on LINT-NOINET6 kernels without this change, so I'm not sure what the motivation is.

In D51778#1182981, @zlei wrote:

I'm a little confused by PPP links with /128 LL addresses ? Can you elaborate how you setup the PPP links ?