google/netfilter batch insert size limit repro

main.go

package main

import (
	"log"
	// "time"

	"github.com/google/nftables"
	nftexpr "github.com/google/nftables/expr"
)

func buildTable(nft *nftables.Conn, ruleCount int) {

	table := &nftables.Table{
		Name:   "demo-table",
		Family: nftables.TableFamilyIPv4,
	}
	nft.AddTable(table)
	nft.FlushTable(table)

	chain := &nftables.Chain{
		Table: table,
		Name:  "cluster-ips",
	}
	nft.AddChain(chain)

	for i := 1; i <= ruleCount; i++ {
		nft.AddRule(&nftables.Rule{
			Table: table,
			Chain: chain,
			Exprs: []nftexpr.Any{
				&nftexpr.Verdict{
					Kind: nftexpr.VerdictAccept,
				},
			},
		})
	}
}

func replaceTable(count int) bool {
	log.Println("Trying", count, "rules")

	nft := &nftables.Conn{}
	buildTable(nft, count)

	if err := nft.Flush(); err != nil {
		log.Println("nftables error:", err)
		return false
	}
	return true
}

func main() {
	log.Println("Making ever more rules...")
	count := 75
	ok := true
	for ok && count < 200 {
		ok = replaceTable(count)
		count += 5
		// time.Sleep(100 * time.Millisecond)
	}
}