V_irtualise ipfilter

[bz]

Summary

Virtualise ipfilter.  Cleanup some entirely unused parts.  Split

initializzation an teardown into module (once global) and VNET (per
virtual network stack) parts. Sadly had to add very special handling
for sysctls (see commit message in projects/vnet).

[cy]

I've had a chance to review some of the code but not all. Tested on my testbed gateway. No problems so far... I should be able to review the remaining code later this week.

sys/contrib/ipfilter/netinet/ip_fil_freebsd.c

103–104

This should probably be removed through a separate commit so as not to confuse general cleanup with implementation of VNET functionality.

131

An XXX commenting why the cloner was disabled should probably be included for future reference.

[cy]

I can add reasons why later.

sys/contrib/ipfilter/netinet/ip_fil_freebsd.c

217–218

Similarly for ipf_checkp and ipf_savep, genaral cleanup should be committed separately to avoid confusion with actual VNET implenentation vs general cleanup.

sys/contrib/ipfilter/netinet/ip_nat.c

280 ↗

(On Diff #17955)

General cleanup should be a separate commit.

[bz]

I'll do the general cleanup parts separately; sure.

And I'll add a comment to the code on why the ifc event was disabled.

I'd like to commit this no later than Thu if possible, so if anyone else has further comments, please get to them today! Thanks!

[bz]

Remove the unrelated cleanup already committed to head.
Add comment as to why the cloned eventhandler is disabled.
Remove some #if 0ed code block, which sneaked in.