Re: [nft PATCH] datatype: Accept IPv4 addresses for ip6addr_type

[Florian Westphal <fw@strlen.de>]

Phil Sutter <phil@nwl.cc> wrote:
> Complement on-demand ip {s,d}addr expression conversion to IPv4-mapped
> IPv6 by accepting IPv4 addresses in places where an IPv6 one is
> expected. This way users don't have to use IPv4-mapped notation when
> populating sets.
> 
> In order to avoid chaos and breakage, prevent host names (temporarily)
> resolving to IPv4 addresses only from being accepted as IPv6 address.
> Map IPv4 addresses only if users explicitly specified them.

There is a usability issue here that I did not consider.

> -dnat ip6 to 1.2.3.4;fail
> +dnat ip6 to 1.2.3.4;ok;dnat ip6 to ::ffff:1.2.3.4

Pablo, what do you think about this?

I think nft should always return an error here.
I don't see how this makes sense (implicit dnat to a
mapped address).

Phil/Pablo, do you see a way to limit the 1.2.3.4 -> ::ffff:1.2.3.4
expansion to 'add element' ?

Alternatively we could just force users to manually expand the address
when adding ipv4 addresses to ip6_addr sets, but I think its cumbersome.