What happens if the machine runs out of memory while adding new nftables sets atomically?

What happens if the machine runs out of memory while adding new nftables sets atomically?

[Anton]

Hi folks,

While experimenting with adding nftables sets on memory-constrained
devices, I have run into OOM conditions. Currently many embedded
devices such as routers are balancing on the verge of not enough
memory if using nft sets (at least interval sets).

I know that there has been progress on the front of reducing memory
footprint, but it's not yet in the nftables versions supplied by the
distributions, so for now I have to work with the current state of
things.

To be on the safe side, currently my scripts add sets separately from
adding rules and removing sets. I'd like to ask the devs, is it safe
under these conditions to attempt performing all these actions in one
atomic operation? Is previous firewall configuration guaranteed to be
successfully restored if the operation runs into OOM?

Re: What happens if the machine runs out of memory while adding new nftables sets atomically?

[Florian Westphal]

Anton <anton.khazan@gmail.com> wrote:
> To be on the safe side, currently my scripts add sets separately from
> adding rules and removing sets. I'd like to ask the devs, is it safe
> under these conditions to attempt performing all these actions in one
> atomic operation? Is previous firewall configuration guaranteed to be
> successfully restored if the operation runs into OOM?

Old config is removed after new transaction went through, not before.

Re: What happens if the machine runs out of memory while adding new nftables sets atomically?

[Anton]

Thank you. And a followup question: is new config guaranteed to be
removed if the operation runs into OOM?

On Tue, Feb 6, 2024 at 1:12 PM Florian Westphal <fw@strlen.de> wrote:
> Old config is removed after new transaction went through, not before.

Re: What happens if the machine runs out of memory while adding new nftables sets atomically?

[Anton]

(and new sets as well...)

On Tue, Feb 6, 2024 at 2:15 PM Anton <anton.khazan@gmail.com> wrote:
>
> Thank you. And a followup question: is new config guaranteed to be
> removed if the operation runs into OOM?
>
> On Tue, Feb 6, 2024 at 1:12 PM Florian Westphal <fw@strlen.de> wrote:
> > Old config is removed after new transaction went through, not before.

Re: What happens if the machine runs out of memory while adding new nftables sets atomically?

[Florian Westphal]

Anton <anton.khazan@gmail.com> wrote:
> > Thank you. And a followup question: is new config guaranteed to be
> > removed if the operation runs into OOM?

Yes, all changes are backed out again.