Re: nftables monitor json mode is broken

[Phil Sutter <phil@nwl.cc>]

On Wed, Aug 27, 2025 at 10:55:49PM +0200, Phil Sutter wrote:
> Hi,
> 
> On Wed, Aug 27, 2025 at 07:12:36PM +0200, Florian Westphal wrote:
> > as subject says, 'nft monitor -j' is broken.
> > Example:
> > 
> > ./run-tests.sh -j testcases/object.t
> > monitor: running tests from file object.t
> > monitor output differs!
> > --- /tmp/tmp.emU4zIN8UT/tmp.C4TeyO6xYk  2025-08-27 19:05:08.039619097 +0200
> > +++ /tmp/tmp.emU4zIN8UT/tmp.jBOL3aIrp5  2025-08-27 19:05:09.062551248 +0200
> > @@ -1 +1 @@
> > -{"delete": {"quota": {"family": "ip", "name": "q", "table": "t", "handle": 0, "bytes": 26214400, "used": 0, "inv": false}}}
> > +{"delete": {"quota": {"family": "ip", "name": "q", "table": "t", "handle": 0, "bytes": 0, "used": 0, "inv": false}}}
> > monitor output differs!
> > --- /tmp/tmp.emU4zIN8UT/tmp.C4TeyO6xYk  2025-08-27 19:05:10.095619097 +0200
> > +++ /tmp/tmp.emU4zIN8UT/tmp.Guz55knY19  2025-08-27 19:05:11.117393075 +0200
> > @@ -1 +1 @@
> > -{"delete": {"limit": {"family": "ip", "name": "l", "table": "t", "handle": 0, "rate": 1, "per": "second", "burst": 5}}}
> > +{"delete": {"limit": {"family": "ip", "name": "l", "table": "t", "handle": 0, "rate": 0, "per": "error"}}}
> > 
> > I did notice this weeks ago but thought it was a problem on my end
> > and then didn't have time to investigate closer.
> > 
> > But its in fact broken on kernel side, since
> > 
> > netfilter: nf_tables: Reintroduce shortened deletion notifications
> > 
> > In short, unlike the normal output, json output wants to dump
> > everything, but the notifications no longer include the extra data, just
> > the bare minimum to identify the object being deleted.
> 
> Oh crap, I missed this entirely.
> 
> > As noone has complained so far I am inclinded to delete the
> > tests and rip out json support from monitor mode, it seems noone
> > uses it or even runs the tests for it.
> > 
> > Alternatives i see are:
> > 1. implement a cache and query it
> > 2. rework the json mode to be forgiving as to what is set
> >    and what isn't in the object.
> 
> My suggestion:
> - Add special casing for NFT_MSG_DEL* with NFTNL_OUTPUT_JSON as well in
>   monitor.c
> - Pass 'bool delete' to monitor_print_*_json()
> - And on to *_print_json() (or implement *_print_json_bare() to
>   conditionally call from the above
> 
> > Object here also means any object reported in any delete kind,
> > not just NFT_MSG_DELOBJ.  This applies to set elements etc. too,
> > json expects the full info, but the kernel notifications no longer
> > provide this.
> 
> Yes, and there is no proper way to detect these incomplete objects. So
> the only way to fix it is to pass the message type into print routines.
> 
> Funny detail: JSON echo mode is unaffected because it ignores anything
> that's not an add command. %)

Oh, and there is also the same issue regarding flowtable hook deletion
vs. flowtable deletion as fixed by commit 18ddac660dfa1 ("monitor:
Correctly print flowtable updates"). :(