configctl service reload all breaks ipfw/traffic shaping

src/etc/rc.ipfw

@@ -39,6 +39,13 @@ ipfw -q /usr/local/etc/ipfw.rules
 if [ ! -f /tmp/ipfw.firstload ]; then
 	# we need to make sure ipfw is loaded as last
 	touch /tmp/ipfw.firstload
+
+	# Enable ipfw now, to ensure its hooks are loaded, before we fix the ipfw/pf order.
+	# Without this, ipfw stop/start will disable/re-enable ipfw, but the re-enable part
+	# is done by /etc/rc.d/ipfw after this, so the hooks will be in the wrong order.
+	sysctl net.inet.ip.fw.enable=1
+	sysctl net.inet6.ip6.fw.enable=1
+
 	pfctl -d
 	pfctl -e
 fi

src/etc/rc.ipfw_stop

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+if [ "$1" = quietstop ]; then
+	# Force first load behaviour on next ipfw start, to fix ipfw/pf ordering.
+	rm -f /tmp/ipfw.firstload
+fi

src/opnsense/service/templates/OPNsense/IPFW/rc.conf.d

@@ -20,4 +20,5 @@
 dummynet_enable="YES"
 firewall_enable="{% if shapers or cp_zones %}YES{% else %}NO{% endif %}"
 firewall_script="/usr/local/etc/rc.ipfw"
+firewall_coscripts="/usr/local/etc/rc.ipfw_stop"
 ipfw_defer="YES"