nat64: T6403: validate source prefix for RFC compliance

[talmakion]

Change Summary

Simplest fix is to comply with RFC6052. The code change is just masking out the relevant bits and ensuring they're zeroed.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T6403

Related PR(s)

Component(s) name

• nat64

Proposed changes

This just ensures the configured source prefix will be accepted by Jool.

It may be preferable to --force the config for maximum flexibility, but I've opted for standards compliance here (and it's a bit less work).

How to test

vyos@TEST-VYOS-LEFT# compare
+ nat64 {
+     source {
+         rule 10 {
+             source {
+                 prefix "64:2001:db8:101:101::/96"
+             }
+             translation {
+                 pool 10 {
+                     address "192.0.2.1"
+                     port "1-65535"
+                 }
+             }
+         }
+     }
+ }

[edit]
vyos@TEST-VYOS-LEFT# commit
[ nat64 ]
Source NAT64 rule 10 source prefix is not RFC6052-compliant: bits 64 to
71 (9th octet) must be zeroed

[[nat64]] failed
Commit failed
[edit]
vyos@TEST-VYOS-LEFT# set nat64 source rule 10 source prefix 64:2001:db8:101:1::/96
[edit]
vyos@TEST-VYOS-LEFT# commit
[edit]
vyos@TEST-VYOS-LEFT# 

Smoketest result

$ python3 /usr/libexec/vyos/tests/smoke/cli/test_nat64.py
test_snat64 (main.TestNAT64.test_snat64) ... ok

---

Ran 1 test in 12.396s

OK

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[talmakion]

I did consider using --force with Jool to just allow it, but this may have other undesirable impacts. The Jool issue goes over how it's probably an oversight of the RFC creators but they'll only accept it with --force.