Sets nesting/reference? Complex concatenations in vmaps?

["William N." <netfilter@riseup.net>]

Hi,

I am trying to use one set inside another. However, none of my two
attempts work. Simplified example:

# cat test 
#!/usr/sbin/nft -f

table ip6 t {
        define ranges = {
                2001:db8:85::/60,
                2001:dd8:23::/48,
		# ...
        }

        set ONE {
                type ipv6_addr
                flags interval
                auto-merge
                counter packets 0 bytes 0
                elements = { $ranges }
        }

        set TWO {
                type icmpv6_type . icmpv6_code . ipv6_addr . ipv6_addr
                flags interval
                auto-merge
                counter packets 0 bytes 0
                elements = {
                        1 . 2 . ::/0 . @ONE,
                        3 . 4 . ::/0 . $ranges
			# ...
                }
        }
}

# nft -c -f test 
test:22:19-19: Error: syntax error, unexpected @
                        1 . 2 . ::/0 . @ONE,
                                       ^
test:23:4-4: Error: syntax error, unexpected number
                        3 . 4 . ::/0 . $ranges
                        ^
test:26:1-1: Error: syntax error, unexpected '}'
}
^

# nft -v
nftables v1.0.6 (Lester Gooch #5)


What is the correct way to do this?


XY: Ideally, I would also like to have similarly structured vmaps,
including also 'ct state' as part of the concatenations in a complex
vmap, instead of a set, e.g. (pseudo code):

iifgroup . icmpv6_type . icmpv6_code . ip6_saddr . ip6_daddr . ct_state : verdict

What is the syntax for that?