tag on each matching rule, not just the last one.
tag on each matching rule, not just the last one.

idea from theo.

to speed that up the real mbuf tag is not written until we hit the last match
but an internal variable is used to track the tag.

this can be used to split classification and policy enforcement, for example.
and much much much more...

ok dhartmei@ frantzen@

orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars