Re: aarch64 - netlink: Error: Could not process rule: No buffer space available

On 4/3/26 11:53, Pablo Neira Ayuso wrote:
--snip--
>> Apologies - its behind the firewall that I'm debugging :)
>>
>> Mirrored here: https://pastebin.com/iTa9XRCb
> 
> This is insane:
> while IFS= read -r line; do
>   ...
>   echo "add element $TABLE_FAMILY $TABLE_NAME $set_name { $batch }" | nft -f -
> 
> this is one transaction per command.
> 
> This is as bad as a shell script with explicit iptables invocations,
> one per line. This is an antipattern.

Yep - it isn't optimal - however it loads up to 512 lines per invocation 
of nft. It isn't meant to be a production or solution - just proof that 
the set is actually good and can be loaded successfully - even if the 
set is loaded at up to 512 elements at a time.

At this moment, I've had no success loading the entire set via the 
normal methods - being uncommenting these two lines:

include "/etc/nftables/firewall/geo-nft/countrysets/AU.ipv4";
include "/etc/nftables/firewall/geo-nft/countrysets/AU.ipv6";

table inet filter {
	set au-ipv4 {
	        type ipv4_addr
	        flags interval
	        auto-merge
	        #elements = { $AU.ipv4 }
	}

	set au-ipv6 {
	        type ipv6_addr
	        flags interval
	        auto-merge
	        #elements = { $AU.ipv6 }
	}
}

At best, its a workaround for now. I can work with it until nft 1.1.7 if 
you believe this should work correctly in that version?

I don't have an aarch64 cross-compile setup on this system (its an 
embedded 8 core ARM board based on the rk3588 SOC) - so I can probably 
monitor Fedora's Bodhi instance here until 1.1.7 is released and built:
	https://bodhi.fedoraproject.org/updates/?search=nftables

-- 
Steven Haigh

📧 [email protected]
💻 https://crc.id.au