When calculating the sequence number to use in an ip6fw reset, remember to

add one if the SYN flag was set in the original packet. This seems to make
ip6fw reset work correctly for new and in-progress connections. Update
the man page to reflect the fact it now seems to work.

Glanced at by:	ume
MFC after:	2 weeks

sbin/ip6fw/ip6fw.8

@@ -235,7 +235,6 @@ TCP packets only.
 Discard packets that match this rule,
 and try to send a TCP reset (RST) notice.
 The search terminates
-.Em ( "not working yet" ) .
 .It Ar count
 Update counters for all packets that match rule.
 The search continues with the next rule.

sys/netinet6/ip6_fw.c

@@ -810,6 +810,8 @@ got_match:
 					*m = 0;
 					break;
 				}
+				if (tcp->th_flags & TH_SYN)
+					ack++;
 				seq = 0;
 				flags = TH_RST|TH_ACK;
 			}