Skip to main content

NFT052 - Failed to Add the Address to the Set

Agent error code #NFT052 indicates that nft add element failed for a reason the agent could not attribute to a more specific cause. The set was not reported missing and the element was not reported as overlapping, so the failure came from the command itself.

The neighboring causes report their own codes: a set the kernel does not have is #NFT050, and an element blocked by an overlapping one in an interval set is #NFT051. Seeing this code means neither applied.

Before reporting it, the agent retries once with fresh metadata for the set, which clears the common case of a set that was deleted and recreated with different flags since the last grant. A failure that survives that retry is what reaches you.

Common causes include:

  • The privileged call was refused. nft exits with "Operation not permitted" when the escalation rule allows the binary but the kernel refuses the operation, for example under a restrictive container profile without CAP_NET_ADMIN
  • The set is full. A set declared with a size limit rejects additions once it is reached
  • The element shape does not match the set, and re-reading the set did not explain why. A set without flags interval refuses a prefix, and a set without flags timeout refuses an element carrying one
  • The ruleset was being replaced by another tool at that moment
  • The command outran its 15 second limit, which on this host usually means the ruleset is locked by another process

Steps to Resolve

Read the Set Definition

  1. Print the definition: sudo nft list set <family> <table> <set>
  2. Note the type, the flags and any size limit
  3. A set with flags interval expects prefixes, one without it expects single addresses, and only a set with flags timeout can carry a kernel-side expiry

Check Whether the Set Is Full

If the definition carries a size, count the elements against it. Knocknoc removes entries as grants expire, but a set shared with another tool can fill up.

Reproduce the Command by Hand

Run the equivalent addition as the agent's own account to see the kernel's message:

sudo -u knocknoc-agent sudo -n nft add element <family> <table> <set> { 192.0.2.1 }

If that works and the grant does not, the difference is the element the agent sent. The full nft output is written to the agent log against the failed grant.

Check for a Competing Writer

Retry the grant once. A concurrent ruleset replacement is transient and usually clears. If the code keeps returning, check whether firewalld, shorewall-nft or a configuration management run is rewriting the same table underneath the agent.

Back to top