Hi,
On Wed, Aug 27, 2025 at 07:12:36PM +0200, Florian Westphal wrote:
> as subject says, 'nft monitor -j' is broken.
> Example:
>
> ./run-tests.sh -j testcases/object.t
> monitor: running tests from file object.t
> monitor output differs!
> --- /tmp/tmp.emU4zIN8UT/tmp.C4TeyO6xYk 2025-08-27 19:05:08.039619097 +0200
> +++ /tmp/tmp.emU4zIN8UT/tmp.jBOL3aIrp5 2025-08-27 19:05:09.062551248 +0200
> @@ -1 +1 @@
> -{"delete": {"quota": {"family": "ip", "name": "q", "table": "t", "handle": 0, "bytes": 26214400, "used": 0, "inv": false}}}
> +{"delete": {"quota": {"family": "ip", "name": "q", "table": "t", "handle": 0, "bytes": 0, "used": 0, "inv": false}}}
> monitor output differs!
> --- /tmp/tmp.emU4zIN8UT/tmp.C4TeyO6xYk 2025-08-27 19:05:10.095619097 +0200
> +++ /tmp/tmp.emU4zIN8UT/tmp.Guz55knY19 2025-08-27 19:05:11.117393075 +0200
> @@ -1 +1 @@
> -{"delete": {"limit": {"family": "ip", "name": "l", "table": "t", "handle": 0, "rate": 1, "per": "second", "burst": 5}}}
> +{"delete": {"limit": {"family": "ip", "name": "l", "table": "t", "handle": 0, "rate": 0, "per": "error"}}}
>
> I did notice this weeks ago but thought it was a problem on my end
> and then didn't have time to investigate closer.
>
> But its in fact broken on kernel side, since
>
> netfilter: nf_tables: Reintroduce shortened deletion notifications
>
> In short, unlike the normal output, json output wants to dump
> everything, but the notifications no longer include the extra data, just
> the bare minimum to identify the object being deleted.
Oh crap, I missed this entirely.
> As noone has complained so far I am inclinded to delete the
> tests and rip out json support from monitor mode, it seems noone
> uses it or even runs the tests for it.
>
> Alternatives i see are:
> 1. implement a cache and query it
> 2. rework the json mode to be forgiving as to what is set
> and what isn't in the object.
My suggestion:
- Add special casing for NFT_MSG_DEL* with NFTNL_OUTPUT_JSON as well in
monitor.c
- Pass 'bool delete' to monitor_print_*_json()
- And on to *_print_json() (or implement *_print_json_bare() to
conditionally call from the above
> Object here also means any object reported in any delete kind,
> not just NFT_MSG_DELOBJ. This applies to set elements etc. too,
> json expects the full info, but the kernel notifications no longer
> provide this.
Yes, and there is no proper way to detect these incomplete objects. So
the only way to fix it is to pass the message type into print routines.
Funny detail: JSON echo mode is unaffected because it ignores anything
that's not an add command. %)
> Alternative options?
Ignore the problem for now, I'll implement the proposed solution above
tomorrow. I hope with the patch at hand, we can decide whether this goes
into the release or not.
Sorry for the mess!
