Add named dynamic states support.

[ae]

Summary

This patch adds support of named dynamic states to ipfw(4).
The keep-state and check-state now will have additional argument - name.
This name will be assigned to dynamic rule by keep-state opcode.
And then can be matched by check-state opcode or O_PROBE_STATE internal opcode.

This implementation based on the opcode rewriting framework and uses named_objects
for fast lookups. The kernel replaces symbolic names with uint16 indexes and uses
them for matching.

For now to reduce possible breakage and to maximize compatibility introduced default name.
It will be assigned to the rules when user has omitted state name in keep-state and check-state
opcodes. Also if name is ambiguous (can be evaluated as rule opcode) it will be replaced to default.
So, if you load old ruleset, all check-state/keep-state opcodes will have default name.

Note that named states only supported by keep-state rules, limit rules doesn't have this support.

Test Plan

We did basic tests, but didn't used them in production yet.
Also limit rules not tested.

[ae]

Add named states support to limit rules.

o Modify syntax to show that flowname is optional parameter.
o Remove sentence about unsupported IPv6 flows in limit rules. They should be supported.
o Add named states support to limit rules.
o Fix lookup for existing names in dyn_create - always use zero set.
o Remove strange redundant check from lookup_dyn_rule_locked(). We don't

need O_LIMIT_PARENT states here.

[julian]

seems ok from the quick look I gave it
We've needed this feature for a long time.

sbin/ipfw/ipfw.8

756

flowname seems to be not quit the right name for this. statetable maybe