st_swap
if (s1->st_swap == s2->st_swap ||
(s1->st_swap ^ s2->st_swap) == IPFW_KEY_SWAP_ALL)
if (s1->st_swap > s2->st_swap)
if (s->st_swap == key->st_swap) {
KASSERT((s->st_swap & key->st_swap) == 0,