Pr/fredi/masquerade timeouts

[Fredi-raspall]

• further cleanup stateful implementation
• unify some types with port forwarding implementation
• rewrite utils with new packet header matching support
• add flowstatus + state machine for masqueraded flows
• set timeouts for masqueraded flows accordingly.
• The behavior is
  • configured timeout is ignored for ICMP. The timeout is set internally
  • UDP traffic: configured timeout is only applied until traffic gets to "established" state (2-way communication + 1 packet).
  • In the case of DNS (udp 53), the flow is closed (and flows cancelled) on the response.
  • TCP: user timeout ignored until flow becomes established.

Fixes: https://github.com/githedgehog/internal/issues/364

NOTE: this targets #1499

[Copilot]

Pull request overview

This PR refactors stateful NAT masquerading to include a shared flow-status state machine and protocol-aware timeout behavior, while also unifying several NAT/port-forwarding types and packet header access patterns.

Changes:

• Introduces shared NAT types (NatAction, NatFlowStatus, AtomicNatFlowStatus) and applies them across port-forwarding and masquerading.
• Adds masquerade-specific protocol/state-machine logic and rewrites packet mangling using the newer header pattern-matching API.
• Adjusts flow timeout behavior for masqueraded flows (pre-establishment vs established, DNS special-casing, etc.) and updates related formatting/logging.

Reviewed changes

Copilot reviewed 21 out of 22 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
net/src/packet/mod.rs	Updates TryHeaders/TryHeadersMut impls to return concrete Headers.
net/src/headers/mod.rs	Changes TryHeaders/TryHeadersMut traits to return &Headers / &mut Headers.
net/src/flows/flow_key.rs	Removes Uni wrapper doc example.
net/src/flows/flow_info.rs	Adds tracectl trace target initialization; adjusts flow invalidation logging.
net/src/flows/display.rs	Tweaks flow display formatting strings.
net/Cargo.toml	Adds linkme and tracectl dependencies for net crate usage.
nat/src/stateful/state.rs	Unifies masquerade action type with NatAction and adds shared atomic flow status + translation view helper.
nat/src/stateful/protocol.rs	New masquerade flow-status state machine (UDP/TCP/ICMP + DNS special handling).
nat/src/stateful/packet.rs	New masquerade packet rewrite implementation using header pattern matching.
nat/src/stateful/nf.rs	Integrates masquerade status machine and internal timeouts into the stateful NAT datapath.
nat/src/stateful/mod.rs	Wires in new packet and protocol modules.
nat/src/stateful/flows.rs	Updates to use unified NatAction.
nat/src/portfw/test.rs	Updates tests to use unified NatFlowStatus instead of portfw-specific status type.
nat/src/portfw/protocol.rs	Replaces portfw-specific status machine types with NatFlowStatus (and updates logic).
nat/src/portfw/packet.rs	Refactors portfw NAT packet mangling to return typed errors and use header pattern matching.
nat/src/portfw/nf.rs	Updates port-forwarding NF to handle new nat_packet() error-returning API and unified action type.
nat/src/portfw/icmp_handling.rs	Updates ICMP error handling to use unified NatAction and new nat_packet() Result API.
nat/src/portfw/flow_state.rs	Unifies port-forward flow state action/status types with new shared NAT types.
nat/src/port.rs	Adjusts NatPort display formatting.
nat/src/lib.rs	Adds new common module and removes Clone from NatTranslationData.
nat/src/common/mod.rs	New shared NAT action/status/atomic types for both masquerade and port-forwarding.
Dockerfile	Changes runtime user directive from USER root to numeric USER 0.
Cargo.lock	Updates lockfile for new dependencies.

[Copilot]

confidence: 10
tags: ["logic", "style"]

nat_packet is declared pub but lives in a private module (portfw::packet is not public). This will trigger the unreachable_pub lint (and fail under -D warnings). Make the function pub(crate)/pub(super) (or expose the module intentionally) to match its actual visibility requirements.

[Copilot]

confidence: 9
tags: ["logic", "style"]

masquerade() uses xlate.use_ip.try_into().unwrap() to obtain a UnicastIpAddr for SNAT. This can panic if use_ip isn’t unicast (and the comment indicates this is known). Prefer making unicast-ness an invariant (e.g., store UnicastIpAddr in NatTranslate/MasqueradeState for SNAT) or return a typed error instead of unwrapping.

Suggested change

	NatAction::SrcNat => snat(packet, xlate.use_ip.try_into().unwrap(), xlate.nat_port), // FIXME
	NatAction::SrcNat => {
	let src_ip: UnicastIpAddr = xlate
	.use_ip
	.try_into()
	.map_err(|_| NatPacketError::UnsupportedTraffic)?;
	snat(packet, src_ip, xlate.nat_port)
	}

[Fredi-raspall]

Yup, forgot to address the fixme