ipfw3: Fix several comments and error messages

ipfw3: insert the new rule in the beginning

"ipfw3 add" is still the same, while the "ipfw3 insert" is the new method
which will insert the new rule in the beginning of the rule list.

ipfw3_nat: highspeed lockless in-kernel NAT

RB-Tree to stored the state for the outgoing packets, and multidimentional
array of pointers to keep the state for the incoming packets.

ipfw3: remove legacy macros

ipfw3: format

ipfw3: list loaded modules

ipfw3nat: delete the libalias 3

ipfw3: use the headers in include folder

ipfw3(8): Increase stack storage for linename.

To accommodate fully the "Line %d" format and avoid buffer overflow.
Do the same some for ip6fw(8).

ipfw3: lockless in-kernel NAT

The libalias is used in kernel space for in-kernel NAT, and its alias_link
entries are stored with LIST. so all the packets which need to be NAT will scan
against the L

ipfw3: lockless in-kernel NAT

The libalias is used in kernel space for in-kernel NAT, and its alias_link
entries are stored with LIST. so all the packets which need to be NAT will scan
against the LIST and trying to find the matched alias_link. by seperating the
libalias into context of different CPUs, the lock can be removed. and due to the
nature of NAT, the outgoing and incoming packets are possible to be handled by
different CPUs, to ensure the returning packet can be translated properly, the
newly created alias_link is required to be duplicated and inserted into contexts
of both CPUs.

e.g.
ipfw3 nat 1 config if em0
ipfw3 nat 1 all via em0
ipfw3 nat 1 show state

show more ...

ipfw3: new feature 'ipfwsync'

ipfwsync is a new feature to synchronize firewall states between machines
which is running ipfw3 firewall for high availability. ipfw3 can be configured
in centre or ed

ipfw3: new feature 'ipfwsync'

ipfwsync is a new feature to synchronize firewall states between machines
which is running ipfw3 firewall for high availability. ipfw3 can be configured
in centre or edge mode. the centre will automatically sync the states from
centre to the edge.

e.g.
ipfw3 sync edge 5000
ipfw3 sync start edge

ipfw3 sync centre 192.168.1.1:5000,192.168.1.2:5000
ipfw3 sync start centre

ipfw3 sync show config
ipfw3 sync show status
ipfw3 sync test centre 123

show more ...

ipfw3: logging feature

ifconfig ipfw0 create
ipfw3 add allow log 0 icmp

support max=9 pseudo ipfw interfaces.
the logged packets header will be 0x41 & 0x42.
the logged frames can keep the original

ipfw3: logging feature

ifconfig ipfw0 create
ipfw3 add allow log 0 icmp

support max=9 pseudo ipfw interfaces.
the logged packets header will be 0x41 & 0x42.
the logged frames can keep the original MAC.

show more ...

ipfw3: shorten func show_filter and MACRO

ipfw3: func to (re)name the table

ipfw3: func to check if val exists in tbl

usage:
ipfw3 table <id> test <type> <val>
output:
YES, <val> exists in table <id>
NO, <val> not exists in table <id>

ipfw3: support lookup tables

ipfw3: join same filters with or operator

example:
ipfw3 add allow icmp to <ip addr 1> or <ip addr 2> ...

ipfw3: show NAT records

show all 'NAT records' which relate to the 'NAT config 1'
which is same as 'ip show nat translation' in CISCO routers.

usage:
ipfw3 nat 1 show state

ipfw3: stop deleting in-use NAT conf

Ansify a few functions.

ipfw3: Indent two switch()es better and add braces to while().

ipfw3(8): Small indent adjustment.

Fix: buf size issue in do_get/set_x

ipfw3(8): Fix indent.

ipfw2 - Rename FreeBSD ipfw port to ipfw3

* Rename all elements of the port to ipfw3 to reduce confusion.