nat66: T4598: Add exclude options in nat66

[nicolas-fort]

Change Summary

Add exclude options in nat66 rules.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://phabricator.vyos.net/T4598

Component(s) name

nat66

Proposed changes

Add exclude option in nat66. Useful in many scenario, and already supported in nat.

How to test

Configuration:

set nat66 destination rule 10 inbound-interface 'eth1'
set nat66 destination rule 10 destination address '2001:db8::1'
set nat66 destination rule 10 source address 'fc00::01'
set nat66 destination rule 10 exclude
set nat66 destination rule 20 inbound-interface 'eth1'
set nat66 destination rule 20 destination address '2001:db8::1'
set nat66 destination rule 20 translation address 'fc01::1'

set nat66 source rule 10 outbound-interface 'eth1'
set nat66 source rule 10 source prefix 'fc00::/64'
set nat66 source rule 10 destination prefix 'fc99::/64'
set nat66 source rule 10 exclude
set nat66 source rule 20 outbound-interface 'eth1'
set nat66 source rule 20 source prefix 'fc00::/64'
set nat66 source rule 20 translation address 'masquerade'

nftables:

vyos@vyos# sudo nft list table ip6 nat
table ip6 nat {
	chain PREROUTING {
		type nat hook prerouting priority dstnat; policy accept;
		iifname "eth1" counter packets 0 bytes 0 ip6 saddr fc00::1 ip6 daddr 2001:db8::1 return comment "DST-NAT66-10"
		iifname "eth1" counter packets 0 bytes 0 ip6 daddr 2001:db8::1 dnat to fc01::1 comment "DST-NAT66-20"
	}

	chain POSTROUTING {
		type nat hook postrouting priority srcnat; policy accept;
		oifname "eth1" counter packets 0 bytes 0 ip6 saddr fc00::/64 ip6 daddr fc99::/64 return comment "SRC-NAT66-10"
		oifname "eth1" counter packets 0 bytes 0 ip6 saddr fc00::/64 masquerade comment "SRC-NAT66-20"
	}

	chain VYOS_DNPT_HOOK {
	}

	chain VYOS_SNPT_HOOK {
	}
}

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[c-po]

Can we please have a nat-exclude.xml.i so the definition is written only ince and then included where needed?

[nicolas-fort]

Done!