Re: [Bug 1145] nft 0.7: expression.c:966: range_expr_value_low: Assertion '0' failed.

[Florian Westphal <fw@strlen.de>]

bugzilla-daemon@netfilter.org <bugzilla-daemon@netfilter.org> wrote:

[ Switching to email ]

> https://bugzilla.netfilter.org/show_bug.cgi?id=1145
> 
> --- Comment #1 from Ian Kumlien <ian.kumlien@gmail.com> ---
> Is there anything obvious that i'm doing wrong? Is there something else i could
> try?

This boils down to nested sets:

define dnat_host        = 10.1.2.3
define dnat_ports       = { 1234-1567 }

define port_allow = {
        53,             # dns
        $dnat_ports,    # dnat
}
define port_allow_tcp = {
        80,
        443,
        $port_allow
}
define port_allow_udp = {
        67, 68,         # dhcp
        123, 1027,      # ntp
        $port_allow
}

... which we don't support at the moment.

So, should we
a). expand/'inline' the sets?

(i.e. port_allow_tcp would contain
 1234-1567, 53, 80, 443)

b) support lookups within lookups?

This would be needed to support non-anonymous sets within sets.

or

c) never support this?  This would probably need some work on parser
to be able to provide a clean error message rather than BUG() ...

Opinions?