fix(posture-check): parse nft -j set elements without a "val" wrapper - #220
Merged
Conversation
The fence-coverage check grepped nft's JSON for '"val":[0-9]+', but nft
prints plain set elements as "elem":[1001] -- the {"val":...} wrapper only
appears when elements carry attributes (timeout, comment, counter). On a
plain uid set live_uids therefore came back empty and every run paged
"egress fence NOT LOADED" while the fence was demonstrably loaded: a false
alarm, hourly, on the channel whose credibility the design depends on.
Caught on the first manual run after installing the registry-driven
artifacts on a live box. Pull the numbers from everything after "elem":
instead, which matches both serializations.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
posture-check.sh's fence-coverage check parsesnft -j list setoutput withgrep -oE '"val":[0-9]+'. On the nftables shipped with Ubuntu 26.04, plain setelements serialize as
"elem":[1001]— the{"val":...}wrapper only appearswhen elements carry attributes (timeout, comment, counter).
live_uidsthereforecame back empty and the script raised "BusyBee: egress fence NOT LOADED" on
every run — an hourly false page — while
nft list set inet recode_agent agent_uidsshowed the set loaded with uid 1001.A tripwire that cries wolf hourly trains the operator to ignore the exact
channel that exists to make a silent failure noisy.
Fix
Take everything after
"elem":and extract the numbers, which matches bothserializations. Found on the first manual posture-check run after installing the
registry-driven artifacts on the live box (BusyBee); the corrected script was
installed there and runs clean.
Verification
sudo -u recode-agent curl -sI https://api.github.com→ HTTP/2 200;http://example.com→ dropped + alarmed, confirming the fence itself was healthy throughout.🤖 Generated with Claude Code