network: tc/cake: introduce NAT= setting

man/systemd.network.xml

@@ -3587,6 +3587,18 @@ Token=prefixstable:2002:da8:1::</programlisting></para>
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><varname>NAT=</varname></term>
+        <listitem>
+          <para>Takes a boolean value. When true, CAKE performs a NAT lookup before applying
+          flow-isolation rules, to determine the true addresses and port numbers of the packet, to
+          improve fairness between hosts inside the NAT. This has no practical effect when
+          <varname>FlowIsolationMode=</varname> is <literal>none</literal> or <literal>flows</literal>,
+          or if NAT is performed on a different host. Defaults to unset, and the kernel's default is
+          used.</para>
+        </listitem>
+      </varlistentry>
+
     </variablelist>
   </refsect1>
 

src/network/networkd-network-gperf.gperf

@@ -390,6 +390,7 @@ CAKE.AutoRateIngress,                        config_parse_cake_tristate,
 CAKE.OverheadBytes,                          config_parse_cake_overhead,                               QDISC_KIND_CAKE,               0
 CAKE.CompensationMode,                       config_parse_cake_compensation_mode,                      QDISC_KIND_CAKE,               0
 CAKE.FlowIsolationMode,                      config_parse_cake_flow_isolation_mode,                    QDISC_KIND_CAKE,               0
+CAKE.NAT,                                    config_parse_cake_tristate,                               QDISC_KIND_CAKE,               0
 ControlledDelay.Parent,                      config_parse_qdisc_parent,                                QDISC_KIND_CODEL,              0
 ControlledDelay.Handle,                      config_parse_qdisc_handle,                                QDISC_KIND_CODEL,              0
 ControlledDelay.PacketLimit,                 config_parse_controlled_delay_u32,                        QDISC_KIND_CODEL,              0

src/network/tc/cake.c

@@ -22,6 +22,7 @@ static int cake_init(QDisc *qdisc) {
         c->autorate = -1;
         c->compensation_mode = _CAKE_COMPENSATION_MODE_INVALID;
         c->flow_isolation_mode = _CAKE_FLOW_ISOLATION_MODE_INVALID;
+        c->nat = -1;
 
         return 0;
 }
@@ -70,6 +71,12 @@ static int cake_fill_message(Link *link, QDisc *qdisc, sd_netlink_message *req)
                         return log_link_error_errno(link, r, "Could not append TCA_CAKE_FLOW_MODE attribute: %m");
         }
 
+        if (c->nat >= 0) {
+                r = sd_netlink_message_append_u32(req, TCA_CAKE_NAT, c->nat);
+                if (r < 0)
+                        return log_link_error_errno(link, r, "Could not append TCA_CAKE_NAT attribute: %m");
+        }
+
         r = sd_netlink_message_close_container(req);
         if (r < 0)
                 return log_link_error_errno(link, r, "Could not close container TCA_OPTIONS: %m");
@@ -227,6 +234,8 @@ int config_parse_cake_tristate(
 
         if (streq(lvalue, "AutoRateIngress"))
                 dest = &c->autorate;
+        else if (streq(lvalue, "NAT"))
+                dest = &c->nat;
         else
                 assert_not_reached();
 

src/network/tc/cake.h

@@ -42,6 +42,7 @@ typedef struct CommonApplicationsKeptEnhanced {
 
         /* Flow isolation parameters */
         CakeFlowIsolationMode flow_isolation_mode;
+        int nat;
 
 } CommonApplicationsKeptEnhanced;
 

test/fuzz/fuzz-network-parser/directives.network

@@ -472,6 +472,7 @@ AutoRateIngress=
 OverheadBytes=
 CompensationMode=
 FlowIsolationMode=
+NAT=
 [TrafficControlQueueingDiscipline]
 Parent=
 NetworkEmulatorDelaySec=