Re: [nft PATCH 3/7] monitor: Correctly print flowtable updates

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Jun 12, 2025 at 01:52:14PM +0200, Phil Sutter wrote:
> An update deleting a hook from a flowtable was indistinguishable from a
> flowtable deletion.

tests/monitor fails:

--- /tmp/tmp.CxT9laP7kj/tmp.qTOOOcfTUY  2025-06-15 11:44:55.690784518 +0200
+++ /tmp/tmp.CxT9laP7kj/tmp.JdiYcpuAKK  2025-06-15 11:44:56.337658195 +0200
@@ -1 +1,2 @@
-delete flowtable ip t ft
+delete flowtable ip t ft { hook ingress priority 0; devices = { lo }; }
+# new generation 3 by process 2954068 (nft)

> Fixes: 73a8adfc2432e ("monitor: Recognize flowtable add/del events")
> Signed-off-by: Phil Sutter <phil@nwl.cc>
> ---
>  src/monitor.c | 14 +++++++++-----
>  1 file changed, 9 insertions(+), 5 deletions(-)
> 
> diff --git a/src/monitor.c b/src/monitor.c
> index 4ceff94824432..e3e38c2a12b78 100644
> --- a/src/monitor.c
> +++ b/src/monitor.c
> @@ -577,14 +577,18 @@ static int netlink_events_flowtable_cb(const struct nlmsghdr *nlh, int type,
>  		nft_mon_print(monh, "%s ", cmd);
>  
>  		switch (type) {
> +		case NFT_MSG_DELFLOWTABLE:
> +			if (!ft->dev_array_len) {
> +				nft_mon_print(monh, "flowtable %s %s %s",
> +					      family,
> +					      ft->handle.table.name,
> +					      ft->handle.flowtable.name);
> +				break;
> +			}
> +			/* fall through */
>  		case NFT_MSG_NEWFLOWTABLE:
>  			flowtable_print_plain(ft, &monh->ctx->nft->output);
>  			break;
> -		case NFT_MSG_DELFLOWTABLE:
> -			nft_mon_print(monh, "flowtable %s %s %s", family,
> -				      ft->handle.table.name,
> -				      ft->handle.flowtable.name);
> -			break;
>  		}
>  		nft_mon_print(monh, "\n");
>  		break;
> -- 
> 2.49.0
>