Current radix-based implementation of lookup tables in ipfw does
not support non-contiguous prefixes while this type of lookup is
needed to write CPU-effective firewall configurations.

For some of the cases we can reach the goal using a masked table
lookup by adding masked (e.g. zero non-significant bits) records
into a table and then zero non-significant bits in lookup key
prior to making a table lookup.

Obtained from:  Yandex LLC
MFC after:      3 weeks
Relnotes:       yes
Sponsored by:   Yandex LLC
Differential Revision:  https://reviews.freebsd.org/D53694

Reviewed by:	zlei, ngie
MFC after:	1 week
Sponsored by:	Stormshield
Sponsored by:	Klara, Inc.
Differential Revision:	https://reviews.freebsd.org/D54972

When kyua runs a test, it creates a temp directory and sets $HOME to
point to it.  Tests are run with the cwd set to that temp directory.

When a process attaches to a jail, its cwd is set to the root of the
jail.  Modify atf_python to cd to $HOME instead, so that it's easier for
tests to share files.

Reviewed by:	zlei, ngie
MFC after:	2 weeks
Sponsored by:	Stormshield
Sponsored by:	Klara, Inc.
Differential Revision:	https://reviews.freebsd.org/D54971

Teach the vnet support code to set interface MTU. Some tests make use of
this, so have the framework handle it.

Adapt a few pf tests to use this.

Reviewed by:	melifaro
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D54333

Commit 4a77657cbc01 increased the size of several opcodes to ipfw_insn_u32.

Approved by:	ae
Sponsored by:	Netflix
Differential Revision:	https://reviews.freebsd.org/D52876

Test scripts based on atf_python can now pass jail command options via the
'opts' key in the 'vnetX' key of TOPOLOGY.

Reviewed by:	melifaro
MFC after:	1 week
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D52761

When transmit checksum offloading is enabled, if_epair does not
compute checksums, it just marks packets that this computation still
needs to be done. However, some test cases verify the checksum.
Therefore disable this for IPv4 and IPv6.

Reviewed by:		kp
MFC after:		1 week
Differential Revision:	https://reviews.freebsd.org/D52379

This removes knowledge of the implementation of if_epair.
Makes it easier to modify if_epair in future commits.

Reviewed by:	kp
Differential Revision:	https://reviews.freebsd.org/D51205

If we want to clear a flag we have to include '--' before the flag we clear,
otherwise ndp will misparse our command (the getopt call will interpret it as
another option, and reject it).

This caused spurious errors at the end of every atf_python test case such as:

	============================== 1 passed in 7.26s ===============================
	usage: ndp [-nt] hostname
	       ndp [-nt] -a | -c | -p | -r | -H | -P | -R
	       ndp [-nt] -A wait
	       ndp [-nt] -d hostname
	       ndp [-nt] -f filename
	       ndp [-nt] -i interface [flags...]
	       ndp [-nt] -I [interface|delete]
	       ndp [-nt] -s nodename etheraddr [temp] [proxy]

Sponsored by:	Rubicon Communications, LLC ("Netgate")

We're going to start running many of the vnet tests in nested jails (so they
can run in parallel). That means the tests won't be able to load kernel modules,
which we commonly do for if_epair and if_bridge.

Just assume that all vnet tests need this, because so many of them do that we
don't want to manually annotate all of them.
This is essentially a no-op on non-nested tests.

Do the same for the python test framework.

While here also have pflog_init actually call pft_init. While having pflog
loaded implies we have pf too pft_init also checks for vimage support, and now
for if_epair.

Reviewed by:	markj
MFC after:	1 month
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D46039