git: 8d6feaaaa26f - main - ipfilter: Set ipf -T optionlist at boot

The branch main has been updated by cy:

URL: https://cgit.FreeBSD.org/src/commit/?id=8d6feaaaa26f444abb209360e52b993e39cb81bb

commit 8d6feaaaa26f444abb209360e52b993e39cb81bb
Author:     Cy Schubert <cy@FreeBSD.org>
AuthorDate: 2024-10-30 19:28:31 +0000
Commit:     Cy Schubert <cy@FreeBSD.org>
CommitDate: 2024-11-01 18:08:14 +0000

    ipfilter: Set ipf -T optionlist at boot
    
    There is no easy way to set ipfilter optionlist variables during boot.
    Add plumbing to the rc script to support this.
    
    PR:                     130555
    Reviewed by:            jlduran
    MFC                     1 week
    Differential Revision:  https://reviews.freebsd.org/D47346
---
 libexec/rc/rc.conf       | 1 +
 libexec/rc/rc.d/ipfilter | 8 +++++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/libexec/rc/rc.conf b/libexec/rc/rc.conf
index 8f585bc02856..a21c587dcc07 100644
--- a/libexec/rc/rc.conf
+++ b/libexec/rc/rc.conf
@@ -214,6 +214,7 @@ ipfilter_program="/sbin/ipf"	# where the ipfilter program lives
 ipfilter_rules="/etc/ipf.rules"	# rules definition file for ipfilter, see
 				# /usr/src/contrib/ipfilter/rules for examples
 ipfilter_flags=""		# additional flags for ipfilter
+ipfilter_optionlist=""		# optionlist for ipf(8) -T
 ippool_enable="NO"		# Set to YES to enable ip filter pools
 ippool_program="/sbin/ippool"	# where the ippool program lives
 ippool_rules="/etc/ippool.tables"	# rules definition file for ippool
diff --git a/libexec/rc/rc.d/ipfilter b/libexec/rc/rc.d/ipfilter
index d0cb09ab527c..9b64fcff0c7a 100755
--- a/libexec/rc/rc.d/ipfilter
+++ b/libexec/rc/rc.d/ipfilter
@@ -33,7 +33,13 @@ required_modules="ipl:ipfilter"
 ipfilter_start()
 {
 	echo "Enabling ipfilter."
-	if ! ${ipfilter_program:-/sbin/ipf} -V | grep -q 'Running: yes'; then
+	if [ -n "${ifilter_optionlist}" ]; then
+		if ${ipfilter_program:-/sbin/ipf} -V | grep -q 'Running: yes'; then
+			${ipfilter_program:-/sbin/ipf} -D
+		fi
+		${ipfilter_program:-/sbin/ipf} -T "${ipfilter_optionlist}"
+		${ipfilter_program:-/sbin/ipf} -E
+	elif ! ${ipfilter_program:-/sbin/ipf} -V | grep -q 'Running: yes'; then
 		${ipfilter_program:-/sbin/ipf} -E
 	fi
 	${ipfilter_program:-/sbin/ipf} -Fa