Skip to main content

NFT400 - Invalid Response From nft

Agent error code #NFT400 indicates that the agent could not read the nftables sets. Either the listing command failed, or it ran and returned output the agent could not parse. The agent reads the ruleset in JSON form, so anything that disturbs that output lands here.

It is reported in two places. Validate connection reports it when nft --version succeeded but nft list sets did not, which is the everyday shape of a privilege problem: sudo -n refusing the call looks exactly like a broken nft from the agent's side, so it is deliberately not blamed on a sudoers file that may be correct. The backend also reports it when reading a specific set during a grant or a reconciliation fails or returns unreadable output.

An agent with no escalation tool at all reports #NFT001 instead, and a set that is genuinely absent reports #NFT050.

Common causes include:

  • No sudoers or doas rule covers nft for the agent's account, so the non-interactive call is refused
  • A rule exists but requires a password, or names a path that is not the nft on this host
  • The installed nft is too old for JSON output, or was built without it
  • A wrapper script named nft sits on the PATH ahead of the real binary and adds output of its own
  • The listing was cut short by its time limit on a host with a very large or locked ruleset

Steps to Resolve

Check the Rule Covers the Agent's Account and the Right Path

  1. List what the account may run: sudo -l -U knocknoc-agent | grep nft
  2. Compare the paths in the rule against command -v nft. The shipped rule names both /usr/sbin/nft and /sbin/nft for this reason
  3. Confirm the rule is NOPASSWD. A rule that prompts cannot be used non-interactively
  4. knocker enable nftables writes and validates the shipped rule if it is missing or wrong

Run the Listing as the Agent

sudo -u knocknoc-agent sudo -n nft -j list sets | head

This is close to what the agent runs. A refusal, an error, or anything printed before the JSON is the cause.

Check the nft Version and JSON Support

  1. Run nft --version. The backend needs 0.9.0 or later
  2. Confirm the JSON listing parses: sudo nft -j list sets | head
  3. If -j errors, the build lacks JSON support and needs upgrading

Confirm You Are Running the Real Binary

Run command -v nft and check it points at the system binary. A wrapper that prints a banner or a warning line corrupts the JSON before the agent ever sees it.

Look for a Locked or Very Large Ruleset

Every command the agent runs is bounded. The agent asks for the set definitions without their contents where nft supports it, and falls back to the full listing on older versions, which on a busy host can be thousands of elements. A ruleset held by another process presents the same way. The raw output is written to the agent log against the failed operation.

Back to top