Re: aarch64 - netlink: Error: Could not process rule: No buffer space available

Pablo Neira Ayuso
2026-03-04T01:17:05Z

On Wed, Mar 04, 2026 at 12:05:30PM +1100, Steven Haigh wrote:
> On 4/3/26 11:53, Pablo Neira Ayuso wrote:
> --snip--
> > > Apologies - its behind the firewall that I'm debugging :)
> > >
> > > Mirrored here: https://pastebin.com/iTa9XRCb
> >
> > This is insane:
> > while IFS= read -r line; do
> > ...
> > echo "add element $TABLE_FAMILY $TABLE_NAME $set_name { $batch }" | nft -f -
> >
> > this is one transaction per command.
> >
> > This is as bad as a shell script with explicit iptables invocations,
> > one per line. This is an antipattern.
>
> Yep - it isn't optimal - however it loads up to 512 lines per invocation of
> nft. It isn't meant to be a production or solution - just proof that the set
> is actually good and can be loaded successfully - even if the set is loaded
> at up to 512 elements at a time.
>
> At this moment, I've had no success loading the entire set via the normal
> methods - being uncommenting these two lines:
>
> include "/etc/nftables/firewall/geo-nft/countrysets/AU.ipv4";
> include "/etc/nftables/firewall/geo-nft/countrysets/AU.ipv6";
>
> table inet filter {
> set au-ipv4 {
> type ipv4_addr
> flags interval
> auto-merge
> #elements = { $AU.ipv4 }
> }
>
> set au-ipv6 {
> type ipv6_addr
> flags interval
> auto-merge
> #elements = { $AU.ipv6 }
> }
> }
>
> At best, its a workaround for now. I can work with it until nft 1.1.7 if you
> believe this should work correctly in that version?

It should work fine with nftables 1.1.7, yes.

> I don't have an aarch64 cross-compile setup on this system (its an embedded
> 8 core ARM board based on the rk3588 SOC) - so I can probably monitor
> Fedora's Bodhi instance here until 1.1.7 is released and built:
> https://bodhi.fedoraproject.org/updates/?search=nftables

Florian just told me that:

commit 648946966a08e4cb1a71619e3d1b12bd7642de7b
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri Feb 6 13:33:46 2026 +0100

netfilter: nft_set_rbtree: validate open interval overlap

went into -stable 6.18, which I overlook.

Reverting this kernel patch in -stable should also address this issue.