Re: aarch64 - netlink: Error: Could not process rule: No buffer space available

Steven Haigh
2026-03-04T01:05:34Z

On 4/3/26 11:53, Pablo Neira Ayuso wrote:
--snip--
>> Apologies - its behind the firewall that I'm debugging :)
>>
>> Mirrored here: https://pastebin.com/iTa9XRCb
>
> This is insane:
> while IFS= read -r line; do
> ...
> echo "add element $TABLE_FAMILY $TABLE_NAME $set_name { $batch }" | nft -f -
>
> this is one transaction per command.
>
> This is as bad as a shell script with explicit iptables invocations,
> one per line. This is an antipattern.

Yep - it isn't optimal - however it loads up to 512 lines per invocation
of nft. It isn't meant to be a production or solution - just proof that
the set is actually good and can be loaded successfully - even if the
set is loaded at up to 512 elements at a time.

At this moment, I've had no success loading the entire set via the
normal methods - being uncommenting these two lines:

include "/etc/nftables/firewall/geo-nft/countrysets/AU.ipv4";
include "/etc/nftables/firewall/geo-nft/countrysets/AU.ipv6";

table inet filter {
set au-ipv4 {
type ipv4_addr
flags interval
auto-merge
#elements = { $AU.ipv4 }
}

set au-ipv6 {
type ipv6_addr
flags interval
auto-merge
#elements = { $AU.ipv6 }
}
}

At best, its a workaround for now. I can work with it until nft 1.1.7 if
you believe this should work correctly in that version?

I don't have an aarch64 cross-compile setup on this system (its an
embedded 8 core ARM board based on the rk3588 SOC) - so I can probably
monitor Fedora's Bodhi instance here until 1.1.7 is released and built:
https://bodhi.fedoraproject.org/updates/?search=nftables

--
Steven Haigh

📧 netwiz@crc.id.au
💻 https://crc.id.au