Re: aarch64 - netlink: Error: Could not process rule: No buffer space available

Hi Pablo,

Thanks for the reply.

On 4/3/26 11:02, Pablo Neira Ayuso wrote:
> Hi,
> 
> On Wed, Mar 04, 2026 at 10:36:20AM +1100, Steven Haigh wrote:
>> Hi all,
>>
>> Firstly, please CC me in replies as I'm not subscribed to the list.
>>
>> I am currently loading some named sets into nftables using the following
>> configuration:
>>
>> set au-ipv4 {
>>          type ipv4_addr
>>          flags interval
>>          auto-merge
>>          elements = { $AU.ipv4 }
>> }
>>
>> set au-ipv6 {
>>          type ipv6_addr
>>          flags interval
>>          auto-merge
>>          elements = { $AU.ipv6 }
>> }
>>
>> These sets are loaded in the config via:
>> include "/etc/nftables/firewall/geo-nft/countrysets/AU.ipv4";
>> include "/etc/nftables/firewall/geo-nft/countrysets/AU.ipv6";
>>
>> The files are created using the geo-nft.sh script here:
>> https://raw.githubusercontent.com/wirefalls/geo-nft/main/geo-nft.sh
>>
>> When loading these, I get the following fatal error:
>> netlink: Error: Could not process rule: No buffer space available
>>
>> This only seems to happen on the aarch64 installs. The same kernel version +
>> tools version on x86_64 architecture seems to load just fine.
>>
>> $ cat /proc/version
>> Linux version 6.18.15-200.fc43.aarch64
>> (mockbuild@835a9c7eeabc46d3b99996c22f20c9cf) (gcc (GCC) 15.2.1 20260123 (Red
>> Hat 15.2.1-7), GNU ld version 2.45.1-4.fc43) #1 SMP PREEMPT_DYNAMIC Fri Feb
>> 27 22:55:30 UTC 2026
>>
>> $ nft --version
>> nftables v1.1.3 (Commodore Bullmoose #4)
> 
> Can you try latest nftables version to confirm this bug on aarch64 is
> current? Otherwise, try nftables git HEAD snapshot?

I grabbed some scratch builds from Fedora 44 which updated:
	* libnftnl 1.2.9 -> 1.3.1
	* nftables 1.1.3 -> 1.1.6

When processing the files though, a new error occurs:

In file included from ./firewall.nft:7:1-61:
/etc/nftables/firewall/geo-nft/countrysets/AU.ipv4:1646:2-24: Error: 
Could not process rule: File exists
         103.4.84.0-103.4.87.255,
         ^^^^^^^^^^^^^^^^^^^^^^^

Looking at the ranges at / around this line however, I can't see any 
kind of duplicate:

         103.4.16.0-103.4.19.255,
         103.4.55.0-103.4.55.255,
         103.4.60.0-103.4.63.255,
         103.4.84.0-103.4.87.255,
         103.4.120.0-103.4.120.255,
         103.4.122.0-103.4.123.255,
         103.4.132.0-103.4.133.255,

Checking the datafile:
$ grep 103.4.84 geo-nft/countrysets/AU.ipv4
         103.4.84.0-103.4.87.255,

 From what I understand, even if this range did overlap - the auto-merge 
flag should handle this.

>> I've had no success in hunting for why this would be the case.
>>
>> I've found that I can batch-load the sets in ~500 rules at a time, and the
>> entire set will load - but including them at the nftables service level
>> always fails.
>>
>> How should I fix this?
-- 
Steven Haigh

📧 [email protected]
💻 https://crc.id.au