ctnetlink_dump_timestamp() wraps CTA_TIMESTAMP_START and CTA_TIMESTAMP_STOP in a nest, but the spec declares CTA_TIMESTAMP as a flat be64. ynl picks reply attributes out of the attribute set rather than the operation's attribute list, so the mistyped attribute stops the whole dump: Error decoding 'timestamp' from 'conntrack-attrs' Traceback (most recent call last): File "tools/net/ynl/pyynl/cli.py", line 314, in main reply = ynl.dump(args.dump, attrs) File "tools/net/ynl/pyynl/lib/ynl.py", line 1082, in _decode decoded = attr.as_scalar(attr_spec['type'], attr_spec.byte_order) File "tools/net/ynl/pyynl/lib/ynl.py", line 291, in as_scalar return format_.unpack(self.raw)[0] struct.error: unpack requires a buffer of 8 bytes The tstamp extension is only attached when CONFIG_NF_CONNTRACK_TIMESTAMP is enabled and nf_conntrack_timestamp is turned on, which is off by default and is why every dump does not hit this. stop is omitted for live entries, so it stays optional like every other member here. The pad member mirrors counter-attrs, which covers the same nla_put_be64() padding. Reported-by: Sashiko Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260826220444.4054714-1-i.maximets@ovn.org Signed-off-by: Jakub Kicinski --- Documentation/netlink/specs/conntrack.yaml | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/Documentation/netlink/specs/conntrack.yaml b/Documentation/netlink/specs/conntrack.yaml index b1eb102ab843..2b7f16cc4133 100644 --- a/Documentation/netlink/specs/conntrack.yaml +++ b/Documentation/netlink/specs/conntrack.yaml @@ -345,6 +345,20 @@ doc: >- - name: secctx-name type: string + - + name: timestamp-attrs + attributes: + - + name: start + type: u64 + byte-order: big-endian + - + name: stop + type: u64 + byte-order: big-endian + - + name: pad + type: pad - name: synproxy-attrs attributes: @@ -458,8 +472,8 @@ doc: >- nested-attributes: secctx-attrs - name: timestamp - type: u64 - byte-order: big-endian + type: nest + nested-attributes: timestamp-attrs - name: mark-mask type: u32 -- 2.55.0