rulesize
ipfw_alloc_rule(struct ip_fw_chain *chain, size_t rulesize)
rule = malloc(rulesize, M_IPFW, M_WAITOK | M_ZERO);