Rename MOUNTCRITLOCAL to CRITLOCALMOUNTED to avoid a name collision
on case insensitive file systems

Split the local disk availability step into two phases to allow scripts
that pre-populate parts of the system (e.g. a tmpfs based /var) an
easy place to plug in like:

# REQUIRE: mountcritlocal
# BEFORE: MOUNTCRITLOCAL

This also cleans up the existing special handling a bit by separating it
into new scripts. All later scripts now depend on MOUNTCRITLOCAL.
Discussed on tech-userlevel some time ago.

Trailing whitespace

Remove dhclient from the base system.

Discussed here:
https://mail-index.netbsd.org/tech-userlevel/2018/06/21/msg011233.html

branches: 1.10.40; 1.10.42;
Allow pf flags to be specified in rc.conf.
Add default to defaults/rc.d as suggested by lukem@

branches: 1.9.8;
Add "bootconf" to REQUIRE: lines which had beforenetlkm
since removed beforenetlkm required bootconf.

Remove LKMs and switch to the module framework, pass 1.

Proposed on tech-kern@.

branches: 1.7.12;
* Add a stop_boot() function in rc.subr, to terminate a multi-user boot
by killing the parent process. The parent's PID is saved in $RC_PID.
* In all rc.d/* scripts that previously tried to stop the boot,
replace in-line code with "stop_boot".
* Document this.

This should fix PR 29822.

pf needs to be started after the network is up, because some pf rules
derive IP address(es) from the interface (e.g "... from any to fxp0").
This however, creates window for possible attacks from the network.

Implement the solution proposed by YAMAMOTO Takashi:
Add /etc/defaults/pf.boot.conf and load it with the /etc/rc.d/pf_boot
script before starting the network. People who don't like the default
rules can override it with their own /etc/pf.boot.conf.
The default rules have been obtained from OpenBSD.

No objections on: tech-security

Changes suggested by lukem:

1. Order pf to start before the network is configured.

2. If the pf_rules cannot be found at boot time, abort the boot (from the
ipfilter script).

Allow to change the location of the pf ruleset with the variable $pf_rules.

branches: 1.3.2;
Do a "flush all" when disabling pf. This also changes the restart case
to do a "flush all", while the reload case will only reload the rules without
flushing anything.

Suggested by Miles Nordin.

Add an _rc_subr_loaded variable, set to ":" by rc.subr. Scripts can use this
for a speedup by doing:
$_rc_subr_loaded . /etc/rc.subr

rc.d fragment for PF. Peter Postma