Re: aarch64 - netlink: Error: Could not process rule: No buffer space available

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Mar 04, 2026 at 12:05:30PM +1100, Steven Haigh wrote:
> On 4/3/26 11:53, Pablo Neira Ayuso wrote:
> --snip--
> > > Apologies - its behind the firewall that I'm debugging :)
> > > 
> > > Mirrored here: https://pastebin.com/iTa9XRCb
> > 
> > This is insane:
> > while IFS= read -r line; do
> >   ...
> >   echo "add element $TABLE_FAMILY $TABLE_NAME $set_name { $batch }" | nft -f -
> > 
> > this is one transaction per command.
> > 
> > This is as bad as a shell script with explicit iptables invocations,
> > one per line. This is an antipattern.
> 
> Yep - it isn't optimal - however it loads up to 512 lines per invocation of
> nft. It isn't meant to be a production or solution - just proof that the set
> is actually good and can be loaded successfully - even if the set is loaded
> at up to 512 elements at a time.
> 
> At this moment, I've had no success loading the entire set via the normal
> methods - being uncommenting these two lines:
> 
> include "/etc/nftables/firewall/geo-nft/countrysets/AU.ipv4";
> include "/etc/nftables/firewall/geo-nft/countrysets/AU.ipv6";
> 
> table inet filter {
> 	set au-ipv4 {
> 	        type ipv4_addr
> 	        flags interval
> 	        auto-merge
> 	        #elements = { $AU.ipv4 }
> 	}
> 
> 	set au-ipv6 {
> 	        type ipv6_addr
> 	        flags interval
> 	        auto-merge
> 	        #elements = { $AU.ipv6 }
> 	}
> }
> 
> At best, its a workaround for now. I can work with it until nft 1.1.7 if you
> believe this should work correctly in that version?

It should work fine with nftables 1.1.7, yes.

> I don't have an aarch64 cross-compile setup on this system (its an embedded
> 8 core ARM board based on the rk3588 SOC) - so I can probably monitor
> Fedora's Bodhi instance here until 1.1.7 is released and built:
> 	https://bodhi.fedoraproject.org/updates/?search=nftables

Florian just told me that:

commit 648946966a08e4cb1a71619e3d1b12bd7642de7b
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Fri Feb 6 13:33:46 2026 +0100
 
    netfilter: nft_set_rbtree: validate open interval overlap

went into -stable 6.18, which I overlook.

Reverting this kernel patch in -stable should also address this issue.