Sets nesting/reference? Complex concatenations in vmaps?

Sets nesting/reference? Complex concatenations in vmaps?

[William N.]

Hi,

I am trying to use one set inside another. However, none of my two
attempts work. Simplified example:

# cat test 
#!/usr/sbin/nft -f

table ip6 t {
        define ranges = {
                2001:db8:85::/60,
                2001:dd8:23::/48,
		# ...
        }

        set ONE {
                type ipv6_addr
                flags interval
                auto-merge
                counter packets 0 bytes 0
                elements = { $ranges }
        }

        set TWO {
                type icmpv6_type . icmpv6_code . ipv6_addr . ipv6_addr
                flags interval
                auto-merge
                counter packets 0 bytes 0
                elements = {
                        1 . 2 . ::/0 . @ONE,
                        3 . 4 . ::/0 . $ranges
			# ...
                }
        }
}

# nft -c -f test 
test:22:19-19: Error: syntax error, unexpected @
                        1 . 2 . ::/0 . @ONE,
                                       ^
test:23:4-4: Error: syntax error, unexpected number
                        3 . 4 . ::/0 . $ranges
                        ^
test:26:1-1: Error: syntax error, unexpected '}'
}
^

# nft -v
nftables v1.0.6 (Lester Gooch #5)


What is the correct way to do this?


XY: Ideally, I would also like to have similarly structured vmaps,
including also 'ct state' as part of the concatenations in a complex
vmap, instead of a set, e.g. (pseudo code):

iifgroup . icmpv6_type . icmpv6_code . ip6_saddr . ip6_daddr . ct_state : verdict

What is the syntax for that?

Re: Sets nesting/reference? Complex concatenations in vmaps?

[William N.]

Regarding vmaps, I found that this syntax works:

icmpv6 type . icmpv6 code . ip6 saddr . ip6 daddr . ct state vmap {
	1 . 1 . ::/0 . ::/0 . established : continue
}

However, just like with sets, this does not work:

icmpv6 type . icmpv6 code . ip6 saddr . ip6 daddr . ct state vmap {
	1 . 1 . ::/0 . @ONE . established : continue
}

Is there really no way to refer to a set from within a concatenation/map?

Re: Sets nesting/reference? Complex concatenations in vmaps?

[Kerin Millar]

On Thu, 9 May 2024, at 1:42 PM, William N. wrote:
> Regarding vmaps, I found that this syntax works:
>
> icmpv6 type . icmpv6 code . ip6 saddr . ip6 daddr . ct state vmap {
> 	1 . 1 . ::/0 . ::/0 . established : continue
> }
>
> However, just like with sets, this does not work:
>
> icmpv6 type . icmpv6 code . ip6 saddr . ip6 daddr . ct state vmap {
> 	1 . 1 . ::/0 . @ONE . established : continue
> }
>
> Is there really no way to refer to a set from within a concatenation/map?

I have yet to read the original question(s) that you sent to the list but I think the answer is that there is not.

-- 
Kerin Millar

Re: Sets nesting/reference? Complex concatenations in vmaps?

[William N.]

I understand.

What about ct state? Is there a way to have something like (quoting
just the inner line from the map):

1 . 1 . ::/0 . ::/0 . { established,related } : continue

I tried using the sum of hex codes instead of words but I got only
errors.