pfctl: Add modern NAT syntax

[vegeta_tuxpowered.net]

Summary

Now that pfct has separate functions for parsing redirection pools and
ports, we can finally add support for nat-to and rdr-to filter_opts.
NAT and RDR actions are marked by having the respective pools filled in.

Function pf_rule_apply_nat() is responsible for both NAT/RDR and af-to
address translations. It is called both for match rules and the final
pass rule.

Use FreeBSD's original address translation code by splitting it into
pf_translate_compat(). Call this function for old-style NAT ruleset
and for modern NAT rules via pf_rule_apply_nat().

Initialize pfctl_rule's redirection pools on rule allocation, also for
code paths not using expand_rule(), so that they can be safely checked
for being empty in filter_consistent().

Move map-e NAT test to nat.sh for convenience, duplicate critical NAT
tests into _compat (for old-style NAT ruleset) and _pass (for match/
pass) variants.

Features missing:

• binat-to
• usage of modern pf_translate()

[kp]

I think we're missing the associated man page updates.

I'm going to revisit this tomorrow, but I've not seen any issues yet.

sbin/pfctl/parse.y

964–965

Is it worth factoring this out into a pfctl_init_rule() or something?

[vegeta_tuxpowered.net]

I have re-enabled OpenBSD tests. Some of them required modification to resolve port numbers to service names, include the "keep state" keyword, insert commas between table members, not auto-expand redirection table-like syntax into tables.

[kp]

Looks good. It does still need the man page updates. We can probably stea^W borrow those from OpenBSD.

sys/netpfil/pf/pf.c

5993

Yeah, I think that makes sense. It'd save us doing the check in multiple places.
(There.s another one like this in pf_test_rule()).

sys/netpfil/pf/pf_lb.c

809

uint8_t in new code.