Re: [nft PATCH] datatype: Accept IPv4 addresses for ip6addr_type

[Phil Sutter <phil@nwl.cc>]

On Wed, Dec 10, 2025 at 11:08:30PM +0100, Florian Westphal wrote:
> Phil Sutter <phil@nwl.cc> wrote:
> > Complement on-demand ip {s,d}addr expression conversion to IPv4-mapped
> > IPv6 by accepting IPv4 addresses in places where an IPv6 one is
> > expected. This way users don't have to use IPv4-mapped notation when
> > populating sets.
> > 
> > In order to avoid chaos and breakage, prevent host names (temporarily)
> > resolving to IPv4 addresses only from being accepted as IPv6 address.
> > Map IPv4 addresses only if users explicitly specified them.
> 
> There is a usability issue here that I did not consider.
> 
> > -dnat ip6 to 1.2.3.4;fail
> > +dnat ip6 to 1.2.3.4;ok;dnat ip6 to ::ffff:1.2.3.4
> 
> Pablo, what do you think about this?
> 
> I think nft should always return an error here.
> I don't see how this makes sense (implicit dnat to a
> mapped address).
> 
> Phil/Pablo, do you see a way to limit the 1.2.3.4 -> ::ffff:1.2.3.4
> expansion to 'add element' ?

It might be possible for dnat statement to set a flag in eval phase
controlling ip6addr_type_parse() strictness. This should work even with
an anonymous map, e.g.

| dnat ip6 to ip6 saddr map { fec0::1 : 1.2.3.4 }

But this could also be a named map and we probably don't want to check
how it's used before accepting an element.

So all this kind of opens pandora's box and we probably either have to
accept the new ways for users to shoot their feet or:

> Alternatively we could just force users to manually expand the address
> when adding ipv4 addresses to ip6_addr sets, but I think its cumbersome.

Cheers, Phil