Firewall: Rules: Add af-to (address family translation) to filter rules

[Monviech]

Important notices

Before you submit a pull request, we ask you kindly to acknowledge the following:

• I have read the contributing guidelines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I opened an issue first for non-trivial changes and linked it below.
• AI tools were used to create at least part of the code and text submitted herewith.

If AI was used, please disclose:

• Model used:
• Extent of AI involvement:

---

Describe the problem

Fixes: #10570

This adds both NAT64 and NAT46 capabilities as it seems.

Test:

The test are the rules specified in the pf.conf(5) manpage:

root@opn-dev-02:# cat /tmp/rules.debug | grep -i af-to
pass in quick on hn3 inet from {any} to {any} keep state label "5fa6810f-0ca6-4dab-bbc9-7984498e2d0b" af-to inet6 from 2001:db8::1 to 2001:db8::/96 # translation
pass in quick on hn3 inet6 from {any} to {64:ff9b::/96} keep state label "eb8ec833-4395-4bfb-86a1-2a22ca8bf7c1" af-to inet from 198.51.100.1 to 0.0.0.0/0 # translation
root@opn-dev-02:# pfctl -s rules | grep -i af-to
pass in quick on hn3 inet all flags S/SA keep state label "5fa6810f-0ca6-4dab-bbc9-7984498e2d0b" af-to inet6 from 2001:db8::1 to 2001:db8::/96
pass in quick on hn3 inet6 from any to 64:ff9b::/96 flags S/SA keep state label "eb8ec833-4395-4bfb-86a1-2a22ca8bf7c1" af-to inet from 198.51.100.1 to any

[fichtner]

This will not work well with shared forwarding. I suggest this to be something for 27.1 otherwise it will rain bug reports.

[Monviech]

Could add a validation that when shared forwarding is enabled you cannot create af-to rules, and at some point remove that validation?

[fichtner]

No we simply need to test this rigorously and expand the kernel side code. I also expect general bugs in that area relating to shaping, route-to and related functionality.

[Monviech]

route-to and et al are not supported with af-to, the man pages states all routing decisions are overwritten by af-to.

But you are right this looks like a simple change on the surface but the waters are deep indeed.

[fichtner]

Well, the issue is that all the implementation is done in pf_route/pf_route6 so even if it looks like features do not overlap they actually do. There will be more edge cases.

cheers,
Franco

[AdSchellevis]

Eventually we could flip our defaults as well for shared forwarding, when not using ipfw's rules to redirect traffic to dummynet, it should be less needed anyway. But that's more a long term discussion, do we want to maintain it in the long run, or rather have it removed at some point (not something we need to decide right now, but might make certain next steps easier). Food for thought