From 7e3a2d4e9bc37e8f85357509dda5608fb4f98e9f Mon Sep 17 00:00:00 2001
From: H-TTTTT <36735327+H-TTTTT@users.noreply.github.com>
Date: Mon, 20 Jul 2026 09:33:38 +0800
Subject: [PATCH] fix: omit nftables interval end when range hits max address

When To() is 255.255.255.255 / ffff:...:ffff, Next() is invalid. Using
From() as the end key duplicated the start element and caused EEXIST.
Omit the end element so the half-open interval covers through max.

Fixes SagerNet/sing-box#4316
---
 redirect_nftables_exprs.go | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/redirect_nftables_exprs.go b/redirect_nftables_exprs.go
index 24af90f1..8a54c706 100644
--- a/redirect_nftables_exprs.go
+++ b/redirect_nftables_exprs.go
@@ -149,17 +149,16 @@ func nftablesCreateIPSet(
 		if (family == nftables.TableFamilyIPv4) != rr.From().Is4() {
 			continue
 		}
-		endAddr := rr.To().Next()
-		if !endAddr.IsValid() {
-			endAddr = rr.From()
-		}
 		setElements = append(setElements, nftables.SetElement{
 			Key: rr.From().AsSlice(),
 		})
-		setElements = append(setElements, nftables.SetElement{
-			Key:         endAddr.AsSlice(),
-			IntervalEnd: true,
-		})
+		endAddr := rr.To().Next()
+		if endAddr.IsValid() {
+			setElements = append(setElements, nftables.SetElement{
+				Key:         endAddr.AsSlice(),
+				IntervalEnd: true,
+			})
+		}
 	}
 	if appendDefault && len(setElements) == 0 {
 		if family == nftables.TableFamilyIPv4 {