NPF: fast kick

[Maxime Villard <max%m00nbsd.net@localhost>]

Currently, NPF does not immediately kick malformed packets, and performs very
few sanity checks. Here is a patch [1] that fixes that.

When a packet is malformed, we return NPC_FMTERR, and kick it immediately. We
don't send a response (TCP-RST or ICMP).

In addition the checks are strengthened. In particular with fragments:

 * As long as we don't see IPPROTO_FRAGMENT, if we fail to advance in the
   nbuf that's fatal, and we return NPC_FMTERR.

 * After seeing IPPROTO_FRAGMENT for the first time, if we fail to advance
   in the nbuf we roll back to the previous header in the chain and process
   the packet from there.

The point is that after the first IPPROTO_FRAGMENT we are not guaranteed to
find the L4 layer, so it's legitimate to fail. In the other cases, it's not.

Maxime

[1] http://m00nbsd.net/garbage/npf/fastkick.diff