Add pflang.md

* doc/pflang.md: New document.
Update pflang.md

Fix a couple markdown errors.
Add pflua-filter tool.

* src/pf/savefile.lua: Add open_and_mmap helper.
* src/pf/utils.lua: Add now() helper.
* tools/pflua-filter: New tool.
Add tests for pflua-filter

* tools/pflua-filter: Add a shebang line, and chmod +x.

* tools/Makefile: Simple "make check" target.

* Makefile: Visit tools/Makefile as appropriate.
Merge pull request #42 from Igalia/pflua-filter-check

Add tests for pflua-filter
Fix bugs around wrong argument to gettimeofday, pcap_offline_filter

* src/pf.lua: Create a pcap_pkthdr instead of a pcap_record.  They're
  different on 64-bit systems...

* src/pf/libpcap.lua: Update pcap_offline_filter prototype and selftest
  message.

* src/pf/savefile.lua: Remove struct pcap_record_extra, as it's not
  used.

* src/pf/types.lua: Add pcap_pkthdr.

* src/pf/utils.lua: Fix suseconds_t type (!).
Fix compile_filter for pcap_offline_filter

* src/pf.lua (compile_filter): For pcap_offline_filter, just allocate
  one header and mutate its values for each packet.  Seems to prevent
  JIT from seeing the header as dead after allocation.
Add comment on now() and a test

* src/pf/utils.lua: Add a comment about now's epoch, and a test.
Update README

* README.md: Update.
Update README.md
Update README.md
Expand 'host <host>'

   - Add support for parsing: "[ip|arp|rarp] [src|dst] host <host>".
   - Add lowering for "[ip|arp|rarp] [src|dst] host <host>".
   - For the moment only support <host> IPv4 addresses.
Assume qualifier host after [src|dst] if omitted

The BPF syntax document says:

    type

        qualifiers say what kind of thing the id name or number refers to.
        Possible types are host, net , port and portrange. E.g., `host foo',
        `net 128.3', `port 20', `portrange 6000-6008'. If there is no type
        qualifier, host is assumed.
Fix ehost parsing

The regex that checks if an address is an IPv6 address matched MAC
addresses, as a MAC address also starts with two octets.

I added a regex for matching MAC address before the IPv6 match.

In addition to that, MAC addresses can have the second octet of
a segment missing, that means this is a valid MAC address:

f:f:f:3:3:3

Which is the equivalent to f0:f0:f0:30:30:30. I modify the lexer to match
those addresses too.
Add expansion of 'ether [src|dst] [host] <ehost>'
Expand '[src|dst] net <net>'
Refactorize expansion functions of several operators.

Keywords 'ip', 'arp', 'rarp' and 'net' share some common code depending on
whether they are 'src' or 'dst' that can be refactored into a more general
parametrized function.
Implement expansion of 'net <net> mask <netmask>'