Re: nftables and IPv6 prefix delegation (regression vs ip6tables)

[Gordon Fisher <gordfisherman@gmail.com>]

On 11/3/2022 16:12 PM, Florian Westphal wrote:
> Ian Pilcher <arequipeno@gmail.com> wrote:
>> My plan to migrate from iptables to nftables seems to have hit a major
>> snag.  nftables seems to lack the ability to use prefix-independent
>> masks when matching IPv6 addresses.
>>
>> For example, my ISP delegates a /56 prefix, which I can divide into as
>> many as 256 separate /64 subnets.  So a routable IPv6 address in my
>> network can be broken down like this.
>>
>>    pppp:pppp:pppp:ppNN:hhhh:hhhh:hhhh:hhhh
>>
>> Where the p's represent the delegated prefix, the N's represent an
>> internal "network ID", and the h's represent the host address.  The
>> prefix is relatively stable, but it can change occasionally, so hard-
>> coding it into firewall rules is not really an option.
>>
>> Assume that I want to match a particular host (pppp:pppp:pppp:ppc8::1)
>> in a rule.  With ip6tables, I can match this address with this
>> expression:
>>
>>    0:0:0:c8::1/::ff:ffff:ffff:ffff:ffff
> ip6tables-translate suggests:
>
> nft add rule ip6 filter INPUT 'ip6 saddr & ::ff:ffff:ffff:ffff:ffff == ::c8:0:0:0:1'
Out of curiosity, why does ``0:0:0:c8::1`` get translated into 
``::c8:0:0:0:1`` ? Both seem to be correct when you consider the address 
expands to``0:0:0:c8:0:0:0:1`` (or 
``0000:0000:0000:00c8:0000:0000:0000:0001`` in full form.) It seems to 
come down to a program choosing to use the ``::`` 
consecutive-zero-hextet-condenser by looking from one end or the other, 
but is more considered more correct than the other (that could upset 
some programs that use ipv6 addresses?)

-- 
gfish