[backfire] backport masq_src and masq_dest options from trunk firewall