Add ipfw protocol modification module ipfw_pmod

[ae]

Summary

This patch add new ipfw_pmod kernel module, that currently implements tcp-setmss rule action.
It sets TCP MSS value and supports both IPv4 and IPv6.

tcp-setmss rule works like setdscp rule. All TCP packets with SYN flag are matched, and if packet contains MSS TCP option, and its value is greater than specified in tcp-setmss VALUE, it modifies this value and updates TCP checksum if needed.

New O_EXTERNAL_DATA opcode added. It used together with O_EXTERNAL_ACTION opcode, but it does not require creating of some named instances, like O_EXTERNAL_INSTANCE opcode requires.

Later we can add some another opcodes with similar functional, but for different protocols to this ipfw_pmod module.

Test Plan

I tested the rule:

tcp-setmss 1300 tcp from any to any

for locally generated TCP traffic and for forwarded traffic, both IPv4 and IPv6. It modifies MSS value correctly.

[ae]

Modify some comments and error messages. Fix checksum modification
for forwarded traffic.

[wblock]

head/sbin/ipfw/ipfw.8

1126

must be loaded or the kernel must have

1129

s/original/the original/

1130

s/specified/the specified/

1132

The search continues with the next rule
regardless of whether a packet is matched by the
.Cm tcp-setmss
rule.