[lqs]

Summary

• -nat64 bpf: a stateless RFC 7915 translator in a tc BPF program on the egress of the dummy device sixup-nat64. Each IPv6 source gets an address of its own from 198.18.0.0/15; conntrack and the source NAT on the way out do the stateful part, so a MAP-E line's ports keep one allocator. Translated packets go back to the device's ingress.
• Translates TCP, UDP (GSO included), ICMP, and ICMP errors with their quotes (RFC 7915 type/code tables, PTB and Fragmentation Needed MTUs, Parameter Problem pointers, quoted fragments), fragments one by one, behind a prefix of any length RFC 6052 allows.
• A slow path in sixup handles what needs the whole datagram: fragmented ICMP and IPv4 UDP without a checksum. The program hands them over through a BPF ring buffer; sixup reassembles, translates and sends them back through the device, marked.
• Mappings conntrack has no flow for over two sweeps are removed. sixup refuses to start when the pool overlaps an address or route of the host.
• No cilium/ebpf: tools/bpfgen (stdlib only) compiles bpf/nat64.c for either byte order at go generate time and writes the instructions, maps, read-only data and relocations; bpf.go loads them with the bpf() system call alone. The amd64 binary is 98 KB larger than main's, within the 6 MiB limit, and 32-bit big-endian MIPS builds.
• The recipes (en/ja/zh) and the standards document recommend -nat64 bpf, with -nat64 jool for kernels older than 6.6.
• Needs Linux 6.6 or later (tcx).

Test plan

• go build ./... && go vet ./... && go test ./..., and go build ./... for linux, darwin and freebsd
• GOOS=linux golangci-lint run, with and without -tags integration
• ./build.sh for amd64, arm64, mips and mipsle; amd64 at 5,886,112 bytes
• go generate reproduces the committed files byte for byte
• Docker integration suite: end to end behind 64:ff9b::/96 and a /64, with conntrack for IPv6 as sixup's firewall has it (ping, the router's own ping, TCP, UDP, fragments both ways, fragmented ping, UDP without checksum, UDP GSO both ways, ICMP errors incl. quoted fragments, PTB both ways, mapping sweep); the ICMP tables and the RFC 6052 examples through BPF_PROG_TEST_RUN; bpf.go, nat64bpf.go and nat64slow.go at 100% coverage
• On a real router, and against Jool for performance

🤖 Generated with Claude Code

[codecov-commenter]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️