Re: [nft PATCH] src: Implement ip {s,d}addr6 expressions

[Florian Westphal <fw@strlen.de>]

Phil Sutter <phil@nwl.cc> wrote:
> These are pseudo payload expressions which represent an IPv4 packet's
> source or destination address as an IPv4-mapped IPv6 address as
> described in RFC4291 section 2.5.5.2[1]. It helps sharing ruleset
> elements like IP address-based sets/maps between rules for IPv4 and IPv6
> traffic.

OK, but why do we need a new keyword for this?

> +ip saddr6 ::ffff:1.2.3.4;ok
> +ip daddr6 ::ffff:1.2.3.4;ok
> +ip saddr6 { ::ffff:1.2.3.4, feed::c0:ff:ee };ok
> +ip daddr6 { ::ffff:1.2.3.4, feed::c0:ff:ee };ok
> +ip saddr6 ::ffff:1.2.3.4 ip daddr 5.6.7.8;ok

None of these examples make sense to me.  How is this useful?

> --- a/tests/py/ip/ip.t.payload
> +++ b/tests/py/ip/ip.t.payload
> @@ -413,6 +413,40 @@ ip test-ip4 input
>    [ bitwise reg 1 = ( reg 1 & 0xffff0000 ) ^ 0x00000000 ]
>    [ cmp eq reg 1 0xffff0000 ]
>  
> +# ip saddr6 ::ffff:1.2.3.4
> +ip test-ip4 input
> +  [ immediate reg 1 0x00000000 0x00000000 0x0000ffff ]
> +  [ payload load 4b @ network header + 12 => reg 11 ]
> +  [ cmp eq reg 1 0x00000000 0x00000000 0x0000ffff 0x01020304 ]

Its just a more expensive way to express 'ip saddr 1.2.3.4'?
What would be useful is:

set s {
	typeof ip6 saddr
	...
}

nft add element inet t s { 1.2.3.4 }

... which makes nft autotranslate to '::ffff:1.2.3.4', combined
with

add rule inet t c ip saddr @s ...

... where, instead of rejecting this for the wrong size, autopads
the lookup, i.e.

[ immediate reg 1 0x00000000 0x00000000 0x0000ffff ]
[ payload load 4b @ network header + 12 => reg 11 ]
[ lookup ...