NFT400 - Invalid Response From nft

Agent error code #NFT400 indicates that nftthe agent could not read the nftables sets. Either the listing command failed, or it ran and returned output the agent could not parse. The agent reads the ruleset in JSON formform, (so anything that disturbs that output lands here.

It is reported in two places. Validate connection reports it when nft -j-version succeeded but nft list sets), did not, which is the everyday shape of a privilege problem: sudo -n refusing the call looks exactly like a broken nft from the agent's side, so it is deliberately not blamed on a sudoers file that may be correct. The backend also reports it when reading a specific set during a grant or a reconciliation fails or returns unreadable output.

An agent with no escalation tool at all reports #NFT001 instead, and thea responseset didthat notis matchgenuinely theabsent structurereports it expects.#NFT050.

Common causes include:

No sudoers or doas rule covers nft for the agent's account, so the non-interactive call is refused A rule exists but requires a password, or names a path that is not the nft on this host The installed nft is too old to supportfor JSON output, or produceswas abuilt differentwithout JSON schemait A wrapper script named nft issits on the PATH ahead of the real binary and is addingadds output of its own The commandlisting was truncated,cut for exampleshort by aits timeouttime partwaylimit throughon a host with a very large or locked ruleset Output from another program is being interleaved into the response

Steps to Resolve

Check the Rule Covers the Agent's Account and the Right Path

List what the account may run: sudo -l -U knocknoc-agent | grep nft Compare the paths in the rule against command -v nft. The shipped rule names both /usr/sbin/nft and /sbin/nft for this reason Confirm the rule is NOPASSWD. A rule that prompts cannot be used non-interactively knocker enable nftables writes and validates the shipped rule if it is missing or wrong

Run the Listing as the Agent

sudo -u knocknoc-agent sudo -n nft -j list sets | head

This is close to what the agent runs. A refusal, an error, or anything printed before the JSON is the cause.

Check the nft Version and JSON Support

1. Run nft --version. The backend needs 0.9.0 or later
2. Confirm the JSON outputlisting parses: sudo nft -j list sets | head
3. If the command errors on -j, errors, the build lacks JSON support and needs upgrading

Confirm You Are Running the Real Binary

Run command -v nft and confirmcheck it points at the system binary,binary. normally /usr/sbin/nft

A wrapper that prints a banner or a warning line corrupts the JSON before the agent readsever sees it.

Look for a TimeoutLocked onor aVery Large Ruleset

Every command Knocknocthe agent runs hasis bounded. The agent asks for the set definitions without their contents where nft supports it, and falls back to the full listing on older versions, which on a time limit. On abusy host with a very large ruleset the listing can be cutthousands short,of whichelements. A ruleset held by another process presents asthe unparseablesame output.way. The agent log records the raw response alongside this code.

Check the Agent Log

The full nft output is written to the agent log and never to this message. Inspect the log entry recorded withagainst the failed operation to see what was actually returned.operation.